Poster: Long PHP webshell files detection based on sliding window attention

TL;DR

This paper presents a novel webshell detection method that converts PHP code to opcodes, extracts features, and uses a sliding window attention mechanism with deep learning to effectively detect long webshell files and new variants.

Contribution

It introduces a sliding window attention mechanism combined with CodeBert and FastText for improved detection of long and obfuscated webshell files.

Findings

High detection accuracy achieved

Effective detection of long webshell files

Addresses limitations of traditional methods

Abstract

Webshell is a type of backdoor, and web applications are widely exposed to webshell injection attacks. Therefore, it is important to study webshell detection techniques. In this study, we propose a webshell detection method. We first convert PHP source code to opcodes and then extract Opcode Double-Tuples (ODTs). Next, we combine CodeBert and FastText models for feature representation and classification. To address the challenge that deep learning methods have difficulty detecting long webshell files, we introduce a sliding window attention mechanism. This approach effectively captures malicious behavior within long files. Experimental results show that our method reaches high accuracy in webshell detection, solving the problem of traditional methods that struggle to address new webshell variants and anti-detection techniques.