Abstract:

[Objective] Webshell is an executable script generated by implanting a Trojan horse through injection, XSS, upload, and other vulnerability penetration means. Because of the difference in construction language, variable exploitation methods, and stealthy nature, the study of the Webshell detection methods is demanded, which can accurately discover the malicious attack behavior of infiltrating and invading websites, and is of positive significance in early warning, research and judgment, and combating hacker-like cases such as illegal invasion of computer information systems. [Methods] This paper proposes an innovative method to study behavioral data and extract features based on Webshell malicious code, and implements the feature-based Webshell detection and network security threat intelligence modeling experiments and applications for HTTP traffic. [Results] The results from experiments and actual deployment show that the extracted feature values can identify Webshells with high accuracy and can effectively detect malicious attacks. [Conclusions] Although the detection method based on feature engineering has the disadvantage of heavy maintenance, it achieves higher accuracy and efficiency in detecting known specific attacks, which is very valuable in the practical application of preventing and combating hacking crimes.

Key words: hacking crime, Webshell, HTTP protocol, feature engineering, cybersecurity threats