WebShell detection based on deep residual network

doi:10.1007/s10664-025-10723-0

WebShell detection based on deep residual network

2025-10-29

0

PRE

AI

DOI：10.1007/s10664-025-10723-0

Original

Original request for help

Save

Abstract

En 中文

Software security is a cornerstone of modern digital infrastructure, with static code analysis playing a pivotal role in identifying vulnerabilities and detecting malicious code. Among the many threats to software security, WebShell, a command execution environment written in scripting languages, stand out as one of the most commonly used attack tools by cyber attackers. Once a WebShell is deployed on a compromised web server, attackers can gain unauthorized control, execute malicious actions, and escalate their operations, posing severe risks to software systems. Detecting WebShells effectively remains a critical challenge in the field of software security. Traditional feature matching-based methods fail to identify new and obfuscated WebShell variants, while machine learning approaches are often hindered by complex feature engineering and limited adaptability to unknown threats. This paper introduces a novel WebShell detection method that transforms WebShell code files into grayscale images, reframing the detection task as an image classification problem. Leveraging a deep residual network enhanced with a hybrid attention mechanism and spatial pyramid pooling, the proposed method achieves high detection accuracy. Experimental results show its efficacy in identifying PHP, JSP and ASP WebShells, with a maximum accuracy of 98.53% and a recall of 98.73%.

Keywords:

WebShell

Multilayer perceptron

Residual networks

Attention mechanism

Grayscale image

WebShell detection based on deep residual network

Abstract

Journal

Organization