SmartEagleEye:A Cloud-Oriented Webshell Detection System Based on Dynamic Gray-Box and Deep Learning  

作　　者：Xin Liu Yingli Zhang Qingchen Yu Jiajun Min Jun Shen Rui Zhou Qingguo Zhou 

机构地区：[1]School of Information Science and Engineering,Lanzhou University,Lanzhou 730000,China [2]College of Computer Science and Technology,Zhejiang University,Hangzhou 310058,China [3]School of Computing and Information Technology,University of Wollongong,Wollongong 2500,Australia

出　　处：《Tsinghua Science and Technology》2024年第3期766-783,共18页清华大学学报（自然科学版（英文版）

基　　金：supported by the National Key R&DProgram of China(No.2020YFC0832500);the Scienceand Technology Plan of Gansu Province(Nos.22ZD6GA048 and 22YF7GA004);theSupercomputing Center of Lanzhou University.

摘　　要：Compared with traditional environments,the cloud environment exposes online services to additional vulnerabilities and threats of cyber attacks,and the cyber security of cloud platforms is becoming increasingly prominent.A piece of code,known as a Webshell,is usually uploaded to the target servers to achieve multiple attacks.Preventing Webshell attacks has become a hot spot in current research.Moreover,the traditional Webshell detectors are not built for the cloud,making it highly difficult to play a defensive role in the cloud environment.SmartEagleEye,a Webshell detection system based on deep learning that is successfully applied in various scenarios,is proposed in this paper.This system contains two important components:gray-box and neural network analyzers.The gray-box analyzer defines a series of rules and algorithms for extracting static and dynamic behaviors from the code to make the decision jointly.The neural network analyzer transforms suspicious code into Operation Code(OPCODE)sequences,turning the detection task into a classification problem.Comprehensive experiment results show that SmartEagleEye achieves an encouraging high detection rate and an acceptable false-positive rate,which indicate its capability to provide good protection for the cloud environment.

关 键 词：WEBSHELL detection CLOUD web security deep learning 

分 类 号：TP273[自动化与计算机技术—检测技术与自动化装置] TP18[自动化与计算机技术—控制科学与工程]