An ensemble learning approach for webshell detection

Webshell is a type of malicious script that is written by network attackers based on the characteristics of web programming languages. It usually exists in the form of web files such as ASP, PHP, JSP, or CGI. As a type of website backdoor, attackers often mix ASP or PHP backdoor files with normal web files in the web directory of the website server, and then use a browser to access the ASP or PHP backdoor in order to control the website server. With the rapid development of computer technology, the importance of web security has become more prominent. This article starts from the current mainstream webshell detection methods, analyzes the mechanism and characteristics of webshell detection, and proposes and implements a webshell detection model based on ensemble learning combined with machine learning. The test results show that when the proposed detection method is combined with the feature extraction method, the recall rate reaches 89% and the accuracy rate reaches 95%, which basically meets the requirements of recall rate and accuracy rate in emergency response scenarios for network security.