WeDIGAR: A Light-Weighted Webshell Detection Framework for Satellite and UAV Networks

In satellite and Unmanned Aerial Vehicle (UAV) networks, detecting webshells presents unique challenges, particularly on ground station edge nodes. Large, resource-intensive detection models are not feasible as nodes have insufficient computing power and limited time for analysis. This paper introduces a novel approach for webshell detection tailored for these environments. Our method first extracts structural and semantic Information Granules (IGs) from the HTTP response bodies sent from the remote systems. Next, we construct a causal graph to identify and remove irrelevant IGs that are not linked to the webshell label. Finally, a random forest classifier is applied to the remaining, relevant IGs. This lightweight component has been empirically validated in both laboratory experiments and a simulated industrial application scenario. The results show that our method achieved an impressive accuracy rate exceeding 99% and a response time of less than 10 milliseconds for each request, significantly outperforming legacy systems based on graph convolutional networks.