# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline  & **WTA** & **D-Shield** & **SHELLPUB** & **WebshellKiller** & **WebshellKiller** & **WebshellKiller** & **Loki** & **ClamAV** & **findbot.pl** \\ \hline TP & 1713 & 1608 & 1165 & 897 & 1376 & 1580 & 1474 & 391 & 972 \\ FN & 63 & 168 & 611 & 879 & 400 & 196 & 302 & 1385 & 804 \\ FP & 40 & 3 & 75 & 2 & 53 & 30 & 10 & 1 & 132 \\ TN & 6634 & 6870 & 6798 & 6871 & 6820 & 6843 & 6863 & 6872 & 6741 \\ Accuracy & **0.9881** & 0.9802 & 0.9207 & 0.8981 & 0.9476 & 0.9739 & 0.9639 & 0.8398 & 0.8918 \\ Recall & **0.9645** & 0.9054 & 0.6560 & 0.5051 & 0.7748 & 0.8896 & 0.8300 & 0.2206 & 0.5473 \\ Precision & **0.9772** & 0.9981 & 0.9395 & 0.9978 & 0.9629 & 0.9814 & 0.9933 & 0.9974 & 0.8804 \\ \(F_{83}\) & **0.9746** & 0.9781 & 0.8648 & 0.8349 & 0.9183 & 0.9615 & 0.9557 & 0.5846 & 0.7849 \\ \(F_{1}\) & **0.9708** & 0.9495 & 0.7725 & 0.6707 & 0.8587 & 0.9322 & 0.9043 & 0.3607 & 0.6750 \\ \(F_{15}\) & **0.9684** & 0.9320 & 0.7231 & 0.5956 & 0.8243 & 0.9159 & 0.8742 & 0.2896 & 0.6194 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Comparison of the webshell detection tools. Although our webshell static detection method based on taint analysis analysis had a more complete interprocedural capability than traditional methods and could detect more unknown webshells, it still could not guarantee that it could detect all new unknown webshells. Many factors affect WTA's detection of unknown webshells, such as the propagation rules of the Ogline in this paper not being totally comprehensive, some webshells using new PHP features, and so on. In future work, we will further study the taint propagation rules of the Ogline, which are not involved at present, and expand the current taint propagation logic. In addition, we will update the taint propagation logic of the Ogline in the new version of PHP by updating to it and continue to study the principles and features of new webshells caused by the features of the new version of PHP. In addition, our method is extensible. Specifically, we will further expand the detection objects, such as web application vulnerabilities, SQL injection vulnerabilities, XSS vulnerabilities, and so on. For example, we can build the taint import rules of SQL injection, improve the corresponding taint propagation logic, and find the dangerous functions list of SQL injection separately, then finally realize the detection of SQL injection vulnerabilities. In this paper, the effectiveness of our method in webshell detection was evaluated in a preliminarily fashion. In the future, we will expand to web application vulnerability detection, such as SQL injection vulnerability detection, XSS vulnerability detection, and so on. ## 7 Related Works

In this section, some dynamic feature-based and static feature-based detection methods are introduced, respectively. ### Dynamic Methods

[PERSON] et al. [9] proposed a malicious webshell detection method based on a Convolutional Neural Network (CNN). This method first obtains the HTTP request and then uses word2 vec to represent each word as a vector. In this case, each HTTP request can be transformed into a fixed-size matrix; finally, a model is trained to detect and classify a file based on CNN. In fact, this detection method is based on network traffic, which uses a convolutional neural network to monitor, model, and train the traffic at webshell runtime. This method has better classification performance than the method based on malicious keyword matching, but it also has some drawbacks: First, if attackers reduce the frequency of communication, such as disguising the operations as normal behaviors and executing the required command only once, it would easily bypass the detection based on network traffic. Second, running the webshell in real time results in bad performance and consumes many computing resources, which may lead to the destruction of key nodes in the system. In addition, there are methods to detect abnormal behaviors of the webserver to detect web attacks.