Design and Implementation of an Intelligent WebShell Detection Tool

WebShell is a web application. Based on the HTTP protocol, attackers can control the server through it. Therefore, it is often used by attackers to drop it onto the target server, in order to obtain the permissions of the target server. There are many types of WebShells, including static and dynamic, which are difficult to detect. This article first analyzes the existing WebShell detection technologies, and it is known that most mainstream WebShell detection tools currently use static features for matching. Then, an efficient and accurate WebShell detection tool was designed and implemented, which is based on CNN and can detect unknown types or modified WebShells. CNN is used to train the WebShell samples published on the network to generate a detection model, and the tool has achieved a good detection effect through testing.