Dynamic Behavior-Based Detection Techniques for Encrypted Variant Webshells

Webshell, as a common type of malicious script, is frequently utilized by cyber attackers who execute unauthorized commands on the victim's server to carry out attacks. Strengthening research on Webshell detection techniques is crucial for building a robust cybersecurity defense. Despite significant progress in the field of Webshell detection, these techniques still face numerous challenges. Firstly, the continuous evolution of attacker techniques has enhanced the adversarial capabilities of Webshell, including rapid updates to version variants, as well as the use of advanced obfuscation techniques. Secondly, the use of HTTPS has grown dramatically from 40% in 2014 to 98% in 2023, rendering techniques based on plaintext rules ineffective for detecting Webshell. These technological updates make it difficult for traditional detection methods to effectively identify and defend against Webshell variants based on the HTTPS protocol. To address this problems, we propose a novel dynamic behavior-based detection techniques called DBBDdetect, aiming at detecting encrypted variant Webshell in order to protect critical infrastructure. DBBDdetect delves into the interaction process between the Webshell and the server, extracting three types of feature information. It utilizes CNNs to obtain vector features of the traffic payload and concat statistical features and similar sequential byte behavior features. Then, it uses DBSCAN clustering model to analyze behavioral similarities to detect variant Webshell attacks. This method captures the intrinsic similarities in behavior, and experiments have shown that it achieves a high level of accuracy.