Webshell detection and corresponding system

PURPOSE: A webshell detecting and corresponding system is provided to remotely detect infection based on information collected in a detecting object server without installing a webshell detecting application in the detecting object server, thereby preventing collision with a different application processing in the detecting object server. CONSTITUTION: A script interworking unit (110) inserted into a webpage route of a detecting object server by having a script file form processes interworking with an information collecting script which collects information from the detecting object server. A DB managing unit (120) stores integrity hash information of webpage configuring contents of the detecting object server in a database and manages the integrity hash information. An information analyzing unit (130) compares the integrity hash information stored in the DB managing unit with current hash information of the webpage configuring contents of the detecting object server periodically or aperiodically collected by the information collecting script. The information analyzing unit searches altered webpage configuring contents. [Reference numerals] (110) Script interworking unit; (120) DB managing unit; (130) Information analyzing unit; (140) Corresponding managing unit; (AA) Integrity hash information; (BB) Webshell signature