CodeBiFusion-CNNGRU: A Dual-Channel Attention Based Model with IPSO Optimization for PHP Webshell Detection

With the widespread adoption of web applications, network systems face increasingly severe security threats, among which WebShell attacks are particularly frequent. Due to the ease of writing PHP scripts and the difficulty of detection by traditional methods, PHP-format WebShells are prevalent and pose serious risks. To address this issue, this paper proposes a semantic parallel extraction model named CodeBiFusion-CNNGRU, based on an attention-enhanced transformer. The model first utilizes a-CodeBERT with attention mechanisms to convert PHP source code into high-dimensional word vector representations. These vectors are then processed through a dual-channel parallel structure composed of CNN and BiGRU, extracting deep features from both local patterns and global contextual dependencies. The extracted feature vectors are fused via a weighted integration optimized by an improved Particle Swarm Optimization (IPSO) algorithm, enabling accurate detection of WebShell attacks. Experimental results show that the proposed dual-channel parallel architecture significantly outperforms single-channel and serial configurations in feature representation and detection performance. Moreover, the attention mechanism in A-CodeBERT and the IPSO fusion strategy further enhance the model's effectiveness. The final model achieves an accuracy of 99.47 % and an F1-score of 99.49 % in WebShell detection tasks, demonstrating excellent detection capability and robustness.