Poster: Long PHP webshell files detection based on sliding window attention
Zhiqiang Wang, Haoyu Wang, Lu Hao

TL;DR
This paper presents a novel webshell detection method that converts PHP code to opcodes, extracts features, and uses a sliding window attention mechanism with deep learning to effectively detect long webshell files and new variants.
Contribution
It introduces a sliding window attention mechanism combined with CodeBert and FastText for improved detection of long and obfuscated webshell files.
Findings
High detection accuracy achieved
Effective detection of long webshell files
Addresses limitations of traditional methods
Abstract
Webshell is a type of backdoor, and web applications are widely exposed to webshell injection attacks. Therefore, it is important to study webshell detection techniques. In this study, we propose a webshell detection method. We first convert PHP source code to opcodes and then extract Opcode Double-Tuples (ODTs). Next, we combine CodeBert and FastText models for feature representation and classification. To address the challenge that deep learning methods have difficulty detecting long webshell files, we introduce a sliding window attention mechanism. This approach effectively captures malicious behavior within long files. Experimental results show that our method reaches high accuracy in webshell detection, solving the problem of traditional methods that struggle to address new webshell variants and anti-detection techniques.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Engineering Research · Web Data Mining and Analysis · Web Application Security Vulnerabilities
MethodsSoftmax · Attention Is All You Need · fastText · CodeBERT
