Detection approach of webshell attacks based on multi-dimensional dynamic features

Feature extraction is a critical step when using machine learning. High-quality features help improve model performance. Feature extraction methods are still not perfect in current webshell detection schemes based on machine learning, so there is still room for improvement in webshell detection accuracy. Aimed at solving the imperfect feature extraction problem, a webshell attack detection method based on multi-dimensional dynamic features is proposed. In addition to source code of a PHP file, its opcode sequence is analyzed and processed to reduce the impact of obfuscation and encryption technology on attack detection. To improve webshell detection accuracy, TextRank algorithm of natural language processing is introduced to extract relevant features, providing optimized data for subsequent training machine learning algorithm. Simulation experiment results show that the proposed method can accurately distinguish between normal pages and webshell attacks, and the accuracy rate is as high as 99.574%.