基于余弦相似计算原理的Webshell检测方法
PDF下载 (557)卢冬海,王洋洋,杨春艳.基于余弦相似计算原理的Webshell检测方法[J].宁波大学学报(理工版),2017,30(6):12-15.DOI:
LU Dong-hai,WANG Yang-yang,YANG Chun-yan. A method of detecting Webshell based on cosine similarity calculation principle[J].Journal of Ningbo University(Natural Science & Engineering Edition),2017,30(6):12-15.DOI:
| Title: | A method of detecting Webshell based on cosine similarity calculation principle |
| 作者: | 卢冬海, 王洋洋, 杨春艳 |
| Author(s): | LU Dong-hai, WANG Yang-yang, YANG Chun-yan |
| 关键词: | 相似度; 余弦定理; 网站安全 |
| Keywords: | Webshell; similarity; cosine theorem; web security |
| 分类号: | TN915.08 |
| 文献标识码: | A |
| 摘要: | 常规Webshell检测方法一般基于代码特征库和基于通信特征. 代码混淆和虚假通信等反检测技术的出现, 提升了Webshell隐蔽度, 常规方法难于发现. 为了检测此类隐蔽度较高的Webshell, 采用了抽取程序代码多维Webshell特征, 用余弦相似计算原理度量代码文件间的相似度, 平均相似度极低的文件即为可疑Webshell文件. 实验表明, 正常代码文件间的平均相似度在10-1~10-2量级, 而Webshell文件和正常代码文件的平均相似度在10-4量级, 此方法可以有效地检测出Webshell. |
| Abstract: | The conventional Webshell detection method is based on code feature library or on the characteristics of communication. With the hidden degree increasing, the difficulty with Webshell detection grows using the conventional method. In order to detect the Webshell that has higher hidden degrees, we make multidimensional vectors of Webshell feature from the code files, then compare the similarity between code files using cosine similarity calculation principle. The code file which has very low average similarity is considered a good candidate for Webshell file. Experiment shows that the average similarity between the normal code files is in order of magnitude ranging from 10-1 to 10-2, whereas the average similarity between the normal code file and Webshell file is in the range of 10-4. Therefore, this method can effectively detect Webshell. |
| 参考文献 /References: | [1] 李可, 方滨兴, 崔翔, 等. 基于Webshell的僵尸网络研究[J]. 通信学报, 2016, 37(6):12-18. [2] 360互联网安全中心. 奇虎2015网站安全报告[EB/ OL]. [2016-10-12]. http://zt.360.cn/1101061855.php?dtid= 1101062368&did=1101536490. [3] Netcraft. Web server survey[EB/OL]. [2016-08-16]. https:// news.netcraft.com/archives/2015/11/16/november-2015- web-server-survey.html. [4] F5. F5 Technologies[EB/OL]. [2016-08-03]. https:// devcentral.f5.com/articles/webshells. [5] THORNTON J. Web shell detector[EB/OL]. [2016-08-12]. https://github.com/emposha/PHP-Shell-Detector. [6] 杨明, 王轶骏, 薛质. 高混淆网页木马的研究与检测实现[J]. 计算机工程与设计, 2004, 35(8):2634-2642. [7] 石刘洋, 方勇. 基于Web日志的Webshell检测方法研究[J]. 信息安全研究, 2016, 1(2):66-71. [8] 吴军. 数学之美[M]. 北京: 人民邮电出版社, 2014: 127-130. |
| 备注/Memo: | 收稿日期: 2016?10?25. 宁波大学学报（理工版）网址: http://journallg.nbu.edu.cn/ 第一作者: 卢冬海（1986－）, 男, 浙江台州人, 工程师, 主要研究方向: 网络安全. E-mail: ludonghai@nbu.edu.cn 宁波大学学报（理工版）网址：http://journallg.nbu.edu.cn/ |
