检索结果-内蒙古大学图书馆

GlareShell: Graph learning-based PHP webshell detection for web server of industrial internet

COMPUTER NETWORKS 2024年 245卷

作者： Feng, Pengbin Wei, Dawei Li, Qiaoyang Wang, Qin Hu, Youbing Xi, Ning Ma, Jianfeng Xidian Univ 2 South Taibai Rd Xian 710071 Shaanxi Peoples R China Aeronaut Comp Tech Res Inst 15 Jinye 2nd RdHigh tech Zone Xian 710119 Shaanxi Peoples R China Univ New South Wales High St Sydney NSW 2052 Australia Harbin Inst Technol 92 Xidazhi St Harbin 150001 Heilongjiang Peoples R China

With the explosive growth of the Industrial Internet scale, cyberattacks targeting industrial control systems also increased. The management and operation of Industrial Internet are usually performed via web servers which retain a large attack surface. In the Industrial Internet, attackers usually exploit vulnerabilities to inject malicious codes for remotely executing commands, stealing confidential data, and invading web servers. Existing approaches capture statistical and contextual dependence information from webshell using machine learning (ML) or deep learning (DL) algorithms. However, the semantic feature mining of program code within webshell is not sufficient when entering new types of webshell. In this paper, we propose a graph learningbased PHP webshell detection framework, GlareShell, using the word embedding technique, a risk weight allocation mechanism, and the graph neural network (GNN). First, GlareShell leverages static analysis to extract interprocedural control flow graphs (ICFGs) from PHP script files and then prunes these ICFGs to remove noisy statements. Then, word embedding techniques are employed to generate semantic representations from PHP statements. Next, we design a risk weight allocation mechanism to derive the risk levels of statements and concatenate them with word embeddings as attributions. The identified risk levels could guide the passing of potential attack patterns inside GNN models. Finally, GlareShell builds a GNN classifier directly from the ICFG with corresponding node attributions to identify the malicious PHP scripts. Experiment results on collected datasets prove the promise of our graph learning framework in the webshell detection domain.

关键词： webshell detection Graph neural network Word embedding ICFG

来源：评论

学校读者我要写书评

暂无评论

An Efficient Hybrid webshell detection Method for Webserver of Marine Transportation Systems

引用

IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS 2023年第2期24卷 2630-2642页

作者： Le, Ha, V Nguyen, Tu N. Nguyen, Hoa N. Le, Linh VNU Univ Engn & Technol Dept Informat Syst Hanoi 100000 Vietnam Kennesaw State Univ Coll Comp & Software Engn Marietta GA 30060 USA

An increase in the number of Maritime Intelligent Transport Systems (MITSs) also means an increase in the number of information security risks. Usually, the administration and operation of MITSs are done through web servers that are frequently targeted by hackers. In marine transportation industry, malicious code injection attacks (webshell) has been widely exploited by hackers to take full control of Web servers. Traditional webshell detection methods based on pattern matching that are no longer effective against new types of webshell. This motivates us to investigate the problem of detecting obfuscation or unknown webshells, termed OUW problem. In this work, we propose a pattern-matching-deep-learning hybrid *** webshell detection method (H-DLPMWD) to address the OUW problem. H-DLPMWD is based on Yara-based pattern matching to clean dataset;modeling *** code files as an operation code index (OCI) vectors;and applying CNN method to train and predict webshell in OCI vectors. To validate H-DLPMWD, our rigorous experimentation demonstrates that H-DLPMWD achieves an excellent accuracy of 98.49%, F1-score of 99.01%, and a low false positive rate of 1.75%.

关键词： Malware Codes Deep learning Computer hacking Pattern matching Payloads Indexes Obfuscation webshells webshell detection deep learning pattern matching maritime intelligent transportation systems

来源：评论

学校读者我要写书评

暂无评论

Obfuscated PHP webshell detection Using the webshell Tailored TextRank Algorithm 24

Obfuscated PHP Webshell Detection Using the Webshell Tailore...

引用

39th Annual ACM Symposium on Applied Computing (SAC)

作者： Lee, Hye Ju Hwang, Seon-Jin Pratiwi, Millati Choi, Yoon-Ho Pusan Natl Univ Busan South Korea

ISBN: (纸本)9798400702433

webshells, which are malicious tools that enable unauthorized command execution on web pages, pose threats, such as server attacks and data breaches. In response, system administrators continuously monitor web vulnerabilities and potential webshell attacks. However, attackers often obfuscate webshells to avoid detection. Existing static webshell detection methods commonly rely on static statistical features and focus on obfuscation characteristics. Consequently, this approach may inadvertently increase the likelihood of falsely identifying an obfuscated normal file as a webshell. That is, if obfuscated general files are incorporated into a dataset for algorithm and information protection purposes, an obfuscation bias problem arises, thereby diminishing the webshell detection efficacy. To mitigate this, we propose a webshell detection methodology that leverages a webshell-tailored TextRank algorithm. This approach aims to detect webshells without introducing the biases associated with obfuscation techniques. This method involves deobfuscating the source code and generating a feature matrix from the operation code (opcode) and Abstract Syntax Tree (AST) derived from the code. Its performance was compared with those of machine learning algorithms such as Random Forest (RF), Support Vector Machines (SVM), and Extreme Gradient Boosting (XGBoost).

关键词： webshell webshell detection Feature Extraction webshell-Tailored TextRank

来源：评论

学校读者我要写书评

暂无评论

Multi-language webshell detection based on Abstract Syntax Tree and TreeLSTM 27

Multi-language Webshell Detection based on Abstract Syntax T...

引用

27th International Conference on Computer Supported Cooperative Work in Design (CSCWD)

作者： Shang, Mengchuan Han, Xueying Zhao, Changzhi Cui, Zelin Du, Dan Jiang, Bo Chinese Acad Sci Inst Informat Engn Beijing Peoples R China Univ Chinese Acad Sci Sch Cyber Secur Beijing Peoples R China

ISBN: (纸本)9798350349184;9798350349191

webshell is a command execution environment existing in web containers, which is used by attackers to remotely control servers and illegally access website resources. Accurately detecting webshells is of great significance for maintaining web security. Current research faces several challenges. On the one hand, in order to evade detection, webshells use a large amount of obfuscation, and existing research methods often use source code or opcode, which cannot fully utilize the semantic and syntactic information of webshell code. On the other hand, webshells can be constructed using any web application programming language, while most existing methods only detect one or a few types of webshells. This paper proposes a novel approach called WS-Tree, which effectively utilizes the semantics and syntax of webshells by using abstract syntax tree as input features. The TreeLSTM model is used as an encoder to handle node relationships in the syntax tree, thereby achieving the detection of obfuscated and multi-language webshells. We also propose a new dataset of webshells containing obfuscated and non-obfuscated to prevent dataset leakage. Extensive experiments demonstrate that our proposed model performs better than the state-of-the-art baselines under different webshell programming languages and improves model generalizability.

关键词： webshell detection Abstract Syntax Tree TreeLSTM Multi-language Deep learning

来源：评论

学校读者我要写书评

暂无评论

A proactive method of the webshell detection and prevention based on deep traffic analysis

引用

INTERNATIONAL JOURNAL OF WEB AND GRID SERVICES 2022年第4期18卷 361-383页

作者： Le, Ha, V Du, Hanh P. Nguyen, Hoa N. Nguyen, Cuong N. Hoang, Long, V VNU Univ Engn & Technol Dept Informat Syst Hanoi Vietnam Minist Publ Secur Hanoi Vietnam

The popularity of today's web application has led to web servers frequently the objects of webshell attacks. In this paper, we propose a new deep inspection method that is composed of a deep learning algorithm and signature-based technique for webshell detection, namely DLWSD. Moreover, to avoid bottlenecks, DLWSD built-in DeepInspector inspects in real-time the large-scale traffic flows with a strategy of periodic sampling at a defined frequency and interval for only flows that do not satisfy any signature. DeepInspector can create/update rules from webshell attacking alert results to prevent in future. We also proposed a mechanism using the cross-entropy loss function to regulate the training imbalanced dataset. Our experiments allow validating the performance of DLWSD using a popular dataset CSE-CIC-IDS2018 with the metrics accuracy, F1-score, FPR of 99.99%, 99.98%, and 0.01% respectively. It is also better compared with other studies using the same dataset.

关键词： intrusion detection webshell detection webshell prevention deep neural network DNN DPDK

来源：评论

学校读者我要写书评

暂无评论

ASAF: AI-powered Static Analysis Framework for webshell detection 1

ASAF: AI-powered Static Analysis Framework for Webshell Dete...

引用

1st International Conference on Cryptography and Information Security, VCRIS 2024

作者： Le, Ha V. Hoang, Hieu T. Phung, On V. Nguyen, Hoa N. Office of the Government Hanoi Viet Nam FPT Software Hanoi Viet Nam VNU University of Engineering and Technology Hanoi Viet Nam

ISBN: (纸本)9798331529949

The increasing sophistication and prevalence of webshells present a significant threat to web application security, necessitating the development of more advanced detection methods. This study introduces an AI-powered Static Analysis Framework (ASAF) designed to detect both known and novel webshell variants with high accuracy and efficiency. ASAF combines the pattern-matching capabilities of Yara rules for identifying known webshells with the advanced detection power of Convolutional Neural Networks (CNNs) for uncovering new and obfuscated threats. The framework consists of five core components: (1) Yara, which employs textual and binary pattern matching to detect known webshells;(2) Opcode Vectorization, which translates web source code into opcode sequences for deeper analysis;(3) Dataset Collecting and Cleaning, which ensures the framework is trained on high-quality data;(4) CNN Model, designed to capture intricate patterns in opcode sequences. Through the integration of static signature-based and CNN-based methods, ASAF provides a comprehensive and robust solution for webshell detection. © 2024 IEEE.

关键词： Convolutional Neural Networks Static Analysis webshell detection

来源：评论

学校读者我要写书评

暂无评论

MSDetector: A Static PHP webshell detection System Based on Deep-Learning 1

引用

16th International Symposium on Theoretical Aspects of Software Engineering (TASE)

作者： Cheng, Baijun Guo, Yanhui Ren, Yan Yang, Gang Xu, Guosheng Beijing Univ Posts & Telecommun Natl Engn Res Ctr Mobile Network Secur Sch Cyberspace Secur Beijing 100876 Peoples R China QI ANXIN Technol Grp Inc Beijing Peoples R China Beijing Univ Posts & Telecommun Sch Artificial Intelligence Beijing 100876 Peoples R China

ISBN: (数字)9783031103636

ISBN: (纸本)9783031103636;9783031103629

webshell is a web script containing malicious code fragment, which hackers could use to launch web attacks. Hence, it is of great signifiance to identify whether a web script contains malicious code fragments in the aspect of web security. However, the flexibility of scripting language such as PHP provides attackers the opportunities to obfuscate scripts, making it challenging for traditional rule-based webshell detectors to detect malicious code fragments. Deep learning brings new ideas for webshell detection and improves the effect of detectors. However, the effect of deep learning-based detectors depends on feature engineering and deep learning models. The feature representations and models adopted by existing methods fail to mine the syntactic and semantic features of webshell scripts. To tackle those problems, we design a new code representation called script sequence according to the characteristics of webshell and also we introduce new pretrain task to enhance understanding of deep learning model to syntax information of webshell code. This leads to the design and implementation of Malicious Script Detector (MSDetector). In order to evaluate MSDetector, we present a new PHP webshell dataset. Experimental results prove that MSDetector can achieve higher F1 score and accuracy than other approaches on the dataset.

关键词： webshell detection Code representation Deep learning

来源：评论

学校读者我要写书评

暂无评论

Towards a webshell detection Approach Using Rule-Based and Deep HTTP Traffic Analysis 1

引用

14th International Conference on Computational Collective Intelligence (ICCCI)

作者： Le, Ha, V Vo, Hoang V. Nguyen, Tu N. Nguyen, Hoa N. Du, Hung T. VNU Univ Engn & Technol Dept Informat Syst Hanoi Vietnam Kennesaw State Univ Dept Comp Sci Marietta GA USA

ISBN: (数字)9783031160141

ISBN: (纸本)9783031160141;9783031160134

Web applications are highly vulnerable to injecting malicious code (webshell) attacks. The static analysis is considered the best method to detect webshells. However, this method consumes a lot of time and hardware resources. In this work, we propose a network-based approach that combines the advantage of the rule-based intrusion detection system and deep learning algorithms for webshell detection, termed HRDWD. Specifically, we first consider our rule-based detector for early detection of known webshell and utilize it as a filter to determine HTTP traffics. Then, the HTTP traffics passed through the detector is extracted and represented by 79 features. Finally, the deep neural network model is designed to deeply analyze these features and detect the webshell traffics among the benign ones. To validate the proposed approach, we conduct rigorous experiments to test the performance of HRDWD. The results indicate that HRDWD achieves a high F1-score of 99.98%, an accuracy of 99.96%, and performs better than related models using the same dataset. We put HRDWD into practice to build an IPS system named ***, and this system has proven feasible in real-time detection and prevention of webshell attacks, including unknown types.

关键词： webshell detection Hybrid rule-based and deep analysis Intrusion detection and prevention system Deep neural network

来源：评论

学校读者我要写书评

暂无评论

Deep Learning Based webshell detection Coping with Long Text and Lexical Ambiguity 24th

Deep Learning Based Webshell Detection Coping with Long Text...

引用

24th International Conference on Information and Communications Security (ICICS)

作者： An, Tongjian Shui, Xuefei Gao, Hongkui DAS Secur Co Ltd Hangzhou 310051 Peoples R China

ISBN: (纸本)9783031157776;9783031157769

webshell is a web page used by hackers for communicating with the web server and network intrusion. To detect webshell, deep learning methods are proposed to automatically extract features and mine semantics from PHP script. Although deep learning methods show a promising perspective, challenges still exist including the challenge of text selection when coping with long PHP script, the challenge of coping with lexical ambiguity in programming language and the challenge of decline of generalization ability to unseen PHPs if training samples are not treated reasonably. To resolve these challenges, we propose a two-stage deep learning webshell detectionmethod. In stage one, a TextRank based sentence-level text selection model is proposed to preserve code semantic via extracting high-value code lines. While in stage two, after the tokenization of selected code lines, a CodeBert based token embedding model is utilized to resolve lexical ambiguity and generate token representation vectors. Down-stream task specified classifier is further utilized to detect webshell and to fine-tune the token embedding model. In training procedure, we split training/validation data set more reasonably to prevent data leakage. Besides, for the additional man labour of disposing false alarm in practical application, an extra large benign PHP data set is utilized for more solid validation. Experiments demonstrate the effectiveness of our method.

关键词： webshell detection Deep learning Text selection Lexical ambiguity CodeBert TextRank

来源：评论

学校读者我要写书评

暂无评论

Improving Convolutional Neural Network-Based webshell detection Through Reinforcement Learning 23rd

Improving Convolutional Neural Network-Based Webshell Detect...

引用

23rd International Conference on Information and Communications Security (ICICS)

作者： Wu, Yalun Song, Minglu Li, Yike Tian, Yunzhe Tong, Endong Niu, Wenjia Jia, Bowei Huang, Haixiang Li, Qiong Liu, Jiqiang Beijing Jiaotong Univ Beijing Key Lab Secur & Privacy Intelligent Trans Beijing 100044 Peoples R China

ISBN: (纸本)9783030868901;9783030868895

webshell detection is highly important for network security protection. Conventional methods are based on keywords matching, which heavily relies on experiences of domain experts when facing emerging malicious webshells of various kinds. Recently, machine learning, especially supervised learning, is introduced for webshell detection and has proved to be a great success. As one of state-of-the-art work, neural network (NN) is designed to input a large number of features and enable deep learning. Thus, how to properly combine the advantages of automatic feature selection and the advantages of expert knowledge-based way has become a key issue. Considering that special features to indicate unexpected webshell behaviors for a target business system are usually simple but effective, in this work, we propose a novel approach for improving webshell detection based on convolutional neural network (CNN) through reinforcement learning. We utilize the reinforcement learning of asynchronous advantage actor-critic (A3C) for automatic feature selection, aiming to maximize the expected accuracy of the CNN classifier on a validation dataset by sequentially interacting with the feature space. Moreover, considering the sparseness of feature values, we build the CNN classifier with two convolutional layers and a global pooling. Extensive experiments and analysis have been conducted to demonstrate the effectiveness of our proposed method.

关键词： webshell detection Feature selection Unexpected behavior feature Reinforcement learning Convolutional neural network

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：