Mixed-Models Method Based on Machine Learning in Detecting WebShell Attack

WebShell is a command execution environment in the form of web files and also a remote administration tool in web containers. However, it is also a web page backdoor for attackers. Malicious WebShell endangers safety of the Web services. Traditional detection methods, which suitable for general WebShell attack scripts, are based on rule matching. Effectively detecting mutant WebShell has become a great difficulty in computer security worldwide. Mutant scripts of PHP WebShell are the most numerous, complicated and difficult to detect in all kinds of mutant WebShell. This paper proposed a mixed model based on Machine Learning that is used to detect WebShell in different classifications. Using many feature engineering and sample balancing algorithms, the model mixes Machine Learning algorithms of Random Forest (RF) and Convolutional Neural Networks (CNN). It proposed a practicable intelligent solution for mutant WebShell attack detection with the optimized precision rate over 97%.