用滑动窗口注意力检测长PHP后门，提升对新型变种的识别能力
Poster: Long PHP webshell files detection based on sliding window attention
- 将PHP代码转为操作码，提取双元组特征
- 滑动窗口注意力机制有效捕捉长文件中的恶意模式
- 结合CodeBert与FastText，提升对新变种和反检测技术的鲁棒性
Webshell 是一种后门程序，网络应用普遍面临 Webshell 注入攻击。本文提出一种 Webshell 检测方法：首先将 PHP 源码转换为操作码（opcodes），并提取操作码双元组（ODTs）；随后利用 CodeBert 与 FastText 模型进行特征表示与分类。针对深度学习在长文件检测中表现不佳的问题，引入滑动窗口注意力机制，有效捕获长文件中的恶意行为。实验表明，该方法在检测准确率上表现优异，解决了传统方法难以应对新型 Webshell 变种及反检测技术的问题。
原文摘要 · Abstract (English)
Webshell is a type of backdoor, and web applications are widely exposed to webshell injection attacks. Therefore, it is important to study webshell detection techniques. In this study, we propose a webshell detection method. We first convert PHP source code to opcodes and then extract Opcode Double-Tuples (ODTs). Next, we combine CodeBert and FastText models for feature representation and classification. To address the challenge that deep learning methods have difficulty detecting long webshell files, we introduce a sliding window attention mechanism. This approach effectively captures malicious behavior within long files. Experimental results show that our method reaches high accuracy in webshell detection, solving the problem of traditional methods that struggle to address new webshell variants and anti-detection techniques.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。