基于余弦相似计算原理的Webshell检测方法

常规Webshell检测方法一般基于代码特征库和基于通信特征. 代码混淆和虚假通信等反检测技术的出现, 提升了Webshell隐蔽度, 常规方法难于发现. 为了检测此类隐蔽度较高的Webshell, 采用了抽取程序代码多维Webshell特征, 用余弦相似计算原理度量代码文件间的相似度, 平均相似度极低的文件即为可疑Webshell文件. 实验表明, 正常代码文件间的平均相似度在10-1~10-2量级, 而Webshell文件和正常代码文件的平均相似度在10-4量级, 此方法可以有效地检测出Webshell.

A method of detecting Webshell based on cosine similarity calculation principle

The conventional Webshell detection method is based on code feature library or on the characteristics of communication. With the hidden degree increasing, the difficulty with Webshell detection grows using the conventional method. In order to detect the Webshell that has higher hidden degrees, we make multidimensional vectors of Webshell feature from the code files, then compare the similarity between code files using cosine similarity calculation principle. The code file which has very low average similarity is considered a good candidate for Webshell file. Experiment shows that the average similarity between the normal code files is in order of magnitude ranging from 10-1 to 10-2, whereas the average similarity between the normal code file and Webshell file is in the range of 10-4. Therefore, this method can effectively detect Webshell.