深度学习在webshell检测中的应用研究  

Research on Application of Deep Learning in WebShell Detection

作　　者：邓全才[1] 郭雅静 张子翼 DENG Quan-cai;GUO Ya-jing;ZHANG Zi-yi(Hebei Institute of Architecture and Civil engineering,Zhangjiakou,Hebei 075000)

机构地区：[1]河北建筑工程学院数理系,河北张家口075000

出　　处：《河北建筑工程学院学报》2022年第1期174-177,共4页Journal of Hebei Institute of Architecture and Civil Engineering

基　　金：河北省省属高等学校基本科研业务费研究项目(2021QNJS11)。

摘　　要：分析了WebShell产生原因及其危害性。采用ADFA-LD数据集,训练集和测试集数据的比例为7:3,然后运用Pytorch深度学习框架,设计和实现了一个BP神经网络模型和一个LSTM神经网络模型。BP神经网络层数4层,其中隐藏层2层,第1层隐藏层有100个神经元,第2层隐藏层有50个神经元,激活函数为logistic函数,迭代次数为10,初始学习率设置为0.001。LSTM神经网络层数3层,输入X的特征维度为124,其中隐藏层1层,100个神经元,迭代次数为100,每组数据20个,学习率为0.001。实验表明:两个模型检测精度最终均为95%,说明本文构建的两个神经网络模型在模型结构、参数设置上较合理,因此两个模型能以较高准确率检测Web站点中是否存在WebShell。In this paper,the causes and harmfulness of Webshell are analyzed.Using ADFA-LD data set,the ratio of training set to test set is 7:3,and then using Pytoch deep learning framework,a BP neural network model and an LSTM neural network model are designed and implemented.BP neural network has 4 layers,including 2 hidden layers,100 neurons in the first hidden layer and 50 neurons in the second hidden layer.The activation function is logistic function,the number of iterations is 10,and the initial learning rate is set to 0.001.LSTM neural network has 3 layers,and the characteristic dimension of input X is 124,including 1 hidden layer,100 neurons,100 iterations,20 data in each group,and the learning rate is 0.001.Experiments show that the detection accuracy of the two models is 95%,which shows that the two neural network models constructed in this paper are reasonable in model structure and parameter setting,so the two models can detect whether there is Webshell in the web site with high accuracy.

关 键 词：ADFA-LD BP LSTM 神经网络 WEBSHELL 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]