Webshell detection method and system based on machine learning and dynamic and static analysis

Abstract

The embodiment of the invention provides a Webshell detection method and system based on machine learning and dynamic and static analysis and relates to the technical field of Webshell detection. Themethod comprises the steps of obtaining sample files; extracting static characteristics and dynamic characteristics of the sample files; and obtaining a classification model according to the static characteristics, the dynamic characteristics and a machine learning algorithm, wherein the classification model analyzes to-be-detected files and obtains detection results. According to the method and the system, through adoption a dynamic and static combined analysis method, the characteristics are extracted relatively comprehensively; a great number of Webshell samples and normal webpage samples are learned to form the classification model through adoption of various classification algorithm combined machine learning algorithm; the classification model is high in stability and accurate in classification; through adoption of the classification model, Webshells and variants thereof can be effectively detected; new-type Webshells are predicted; a text mixing method can be coped with well; andthe deficiency resulting from traditionally adopting a characteristic code matching detection mode can be compensated.

Description

technical field [0001] The invention relates to the technical field of Webshell detection, in particular to a method and system for detecting Webshells based on machine learning and dynamic and static analysis. Background technique [0002] With the vigorous development of Internet applications and the rapid growth of Internet data, server security issues are becoming increasingly serious, and web application-based backdoor programs such as Webshell are extremely harmful to user information and even the entire application system, so timely detection and discovery of server vulnerabilities And backdoors, it is very important to ensure the security of the server. [0003] Since Webshells are mostly written in scripting languages, they are easy to modify and deform. Their features are not limited to feature codes, but also include file operation functions, malicious execution functions, file comment size, single-line string length, and degree of confusion. When the feature cod...

AI Technical Summary

Problems solved by technology

[0003] Since Webshells are mostly written in scripting languages, they are easy to modify and deform. Their features are not limited to feature codes, but also include file operation functions, malicious execution functions, file comment size, single-line string length, and degree of confusion. When the feature code is deliberately confused, the traditional method will miss this type of Webshell, that is, it is easy to bypass the detection of firewalls and anti-virus software through obfuscation, so the current Webshell detection method based on feature matching is difficult to quickly detect and identify Webshells. variant

[0004] Therefore, how to overcome the singleness and hysteresis of the traditional webshell detection method based on signature matching, deal with the text obfuscation method of webshell, and realize the rapid detection of webshell and its variants have always been the focus of attention of those skilled in the art

Images