Webshell Detection Based on Explicit Duration Recurrent Network

Abstract

AbstractWebshell is a malicious script, it can be written in multiple languages. Through the webshell, attackers can escalate and maintain persistent access on compromised web applications. With the growth of the demand for interactive web applications, the webshell timely detection in web applications are essential to ensure security of web server. Although there are some existing methods for webshell detection, these methods need a large number of samples to achieve higher accuracy rate. In this paper, we proposed an new webshell detection method based on Explicit Duration Recurrent Network (EDRN). In this method, the opcode sequence of samples is considered as input using word2vec. Comparing with other Recurrent Neural Networks, such as LSTM and GRU, the experimental results illustrate that our model can achieve the better performance, especially when the training set is small.KeywordsWebshell detectionOpcode sequenceWord2vecExplicit Duration Recurrent Network