Abstract:

Webshell, as a covert and harmful web backdoor, has drawn significant attention in the field of cybersecurity. Code obfuscation techniques in Webshells significantly reduce the effectiveness of traditional detection methods, furthermore, many traditional detection models fail to efficiently handle large scale data. Therefore, this paper proposed a method for Webshell detection, BAT-SRU, which combined BERT word embeddings, a bidirectional SRU network, and a self-attention mechanism. This method extracted code features through abstract syntax trees, combined sample de-obfuscation and dangerous function statistics to enhanced feature quality, and used the BAT-SRU model for detection. Existing methods, such as detection based on Word2Vec and bidirectional GRU, classification using opcode sequences and random forest, and AST-based feature extraction with Text-CNN, suffer from insufficient feature representation and poor adaptability to highly obfuscated code. Compared to the aforementioned methods, BAT-SRU demonstrates superior performance in detecting PHP Webshells, achieving an accuracy of 99.68%, precision of 99.13%, recall of 99.22%, and an F1 score of 99.18%. Additionally, when compare to RNN and its variant models, BAT-SRU reduces training time by 23.47% and inference time by 40.14%.

Key words: PHP Webshell, abstract syntax tree, BERT embeddings, SRU, self-attention