A Method of Detecting Webshell Based on Multi-layer Perception

Abstract

WebShell is a commonly used tool for network intrusion. It has the characteristics of high, concealment, great harm and so on. The existing WebShell detection method has higher detection accuracy when detecting a known WebShell, but the accuracy of detection is low when it faces complex and flexible unknown and variant WebShell. To solve this problem, a WebShell detection method based on Multi-Layer Perceptron (MLP) neural network is proposed. Firstly, the sample source code is converted into a sample byte code by a compiler tool, and then the sample byte code is divided into byte code sequences using Bi-Gram. Secondly, TF-IDF is used to calculate the word frequency matrix, and on this basis, the feature matrix of trained sample set is selected. Finally, the detection model is obtained through multi-layer neural network training. The experimental results indicate that compared with the existing methods, the constructed detection model can significantly improve the detection accuracy, accuracy, and recall rate, and the detection, accuracy of unknown and variant samples can reach over 90%.