Incremental learning research for webshell detection

Webshell is a backdoor for web applications and has become a major threat to cyber security. This paper proposes a webshell detection method based on PHP opcodes and deep learning. First, the PHP source code is converted into an opcode and then extracted by Opcode Double-Tuples (ODTs). Then, semantic vector representations are extracted using CodeBert, and FastText is used to improve the feature representation. To address the challenge of long sequences, a sliding window attention (SWA) mechanism is designed. Long sequences are divided into overlapping sub-windows, effectively capturing malicious behavior in long files. Experiments show that the detection method achieves 99.2% accuracy and 99.1% F1 score on the test set, outperforming existing methods. To further address the challenge of evolving webshell variants, this paper proposes an incremental learning method for webshell detection. A joint strategy combining Learning Without Forgetting (LwF) and sample replay is designed. In a simulated two-stage incremental experiment, the joint strategy saves 59.2% of the time compared to full training, with a final task F1 score of 98.43%. This strategy surpasses traditional incremental learning methods such as Elastic Weight Consolidation (EWC). This study provides an efficient and sustainable solution for real-time defense against webshell variants.