Scholarlink

<p>Webshell is a backdoor for web applications and has become a major threat to cyber security. This paper proposes a webshell detection method based on PHP opcodes and deep learning. First, the PHP source code is converted into an opcode and then extracted by Opcode Double-Tuples (ODTs). Then, semantic vector representations are extracted using CodeBert, and FastText is used to improve the feature representation. To address the challenge of long sequences, a sliding window attention (SWA) mechanism is designed. Long sequences are divided into overlapping sub-windows, effectively capturing malicious behavior in long files. Experiments show that the detection method achieves 99.2% accuracy and 99.1% F1 score on the test set, outperforming existing methods. To further address the challenge of evolving webshell variants, this paper proposes an incremental learning method for webshell detection. A joint strategy combining Learning Without Forgetting (LwF) and sample replay is designed. In a simulated two-stage incremental experiment, the joint strategy saves 59.2% of the time compared to full training, with a final task F1 score of 98.43%. This strategy surpasses traditional incremental learning methods such as Elastic Weight Consolidation (EWC). This study provides an efficient and sustainable solution for real-time defense against webshell variants.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Incremental learning research for webshell detection

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年10月14日

查看全文
  • Zhiqiang Wang,
  • Haoyu Wang,
  • Shaowei Yuan,
  • Zhiang Tian

摘要

Webshell is a backdoor for web applications and has become a major threat to cyber security. This paper proposes a webshell detection method based on PHP opcodes and deep learning. First, the PHP source code is converted into an opcode and then extracted by Opcode Double-Tuples (ODTs). Then, semantic vector representations are extracted using CodeBert, and FastText is used to improve the feature representation. To address the challenge of long sequences, a sliding window attention (SWA) mechanism is designed. Long sequences are divided into overlapping sub-windows, effectively capturing malicious behavior in long files. Experiments show that the detection method achieves 99.2% accuracy and 99.1% F1 score on the test set, outperforming existing methods. To further address the challenge of evolving webshell variants, this paper proposes an incremental learning method for webshell detection. A joint strategy combining Learning Without Forgetting (LwF) and sample replay is designed. In a simulated two-stage incremental experiment, the joint strategy saves 59.2% of the time compared to full training, with a final task F1 score of 98.43%. This strategy surpasses traditional incremental learning methods such as Elastic Weight Consolidation (EWC). This study provides an efficient and sustainable solution for real-time defense against webshell variants.