WebshellHunter: A New Webshell Detection Method Based on Abstract Syntax Tree and CNN-BiLSTM

With the rapid advancement of network technologies, the interactivity of web applications has significantly improved. However, this progress has also expanded the attack surface, exposing sensitive information of individuals, enterprises, and even nations to potential security threats. In the cyberattack chain, Webshell function as malicious scripts capable of executing file operations and remote commands, enabling attackers to maintain persistent and covert control over compromised web servers. To maximize the exploitation of 0-day and N-day vulnerabilities, attackers often deploy Webshell post-intrusion as persistent access tools, further amplifying their attack impact. To evade security detection, attackers employ various obfuscation techniques such as encryption, encoding, and code obfuscation, significantly increasing detection difficulty and reducing code readability. However, existing Webshell detection methods still face challenges in feature extraction, and detection accuracy requires further improvement. To address these challenges, this study focuses on optimizing feature extraction and enhancing Webshell detection performance by proposing a CNN-BiLSTM-based Webshell detection system. This approach not only incorporates conventional feature extraction techniques but also leverages BERT to perform text vectorization on the Abstract Syntax Tree (AST) of the code, enabling deeper extraction of Webshell code patterns. Experimental results demonstrate that the proposed method effectively enhances Webshell detection capabilities and improves detection accuracy, providing a more robust defense mechanism for web security.