Enhancing the Feature Profiles of Web Shells by Analyzing the Performance of Multiple Detectors - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

Enhancing the Feature Profiles of Web Shells by Analyzing the Performance of Multiple Detectors

Résumé

Web shells are commonly used to transfer malicious scripts in order to control web servers remotely. Malicious web shells are detected by extracting the feature profiles of known web shells and creating a learning model that classifies malicious samples. This chapter proposes a novel feature profile scheme for characterizing malicious web shells based on the opcode sequences and static properties of PHP scripts. A real-world dataset is employed to compare the performance of the feature profile scheme against state-of-art schemes using various machine learning algorithms. The experimental results demonstrate that the new feature profile scheme significantly reduces the false positive rate.
Fichier principal
Vignette du fichier
503209_1_En_4_Chapter.pdf (164.13 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03657237 , version 1 (02-05-2022)

Licence

Paternité

Identifiants

Citer

Weiqing Huang, Chenggang Jia, Min Yu, Kam-Pui Chow, Jiuming Chen, et al.. Enhancing the Feature Profiles of Web Shells by Analyzing the Performance of Multiple Detectors. 16th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2020, New Delhi, India. pp.57-72, ⟨10.1007/978-3-030-56223-6_4⟩. ⟨hal-03657237⟩
27 Consultations
51 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More