# A Web Shell Detection Method Based on Multiview Feature Fusion
## 3 Methodology
### Feature Extraction  
Feature extraction will be performed after getting a clean data set. Lexical features, syntactic features, and abstract features are considered based on the semantic content as follows:  
1. Lexical features. Lexical features refer to the way (or frequency) of certain words used in the script. We observe that in malicious web shells, since the attacker needs to accept various commands through the web shell to interact with the victim server, a large number of global variables are needed, and their parameters are combined to perform predefined activities. Since global variables are the main way to provide external data to PHP scripts, malicious web shells tend to use various highly parameterized global variables. Therefore, the number of global variables that can represent information that is received is extracted as features. These features contain $_GET (F1), $_POST (F2), $_COOKIE (F3), $_REQUEST (F4), $_FILES (F5), and $_- SESSION (F6). Here, Fx is used to represent the feature.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Family Name** & **The Number of Web Shells** \\ \hline c99 & 326 \\ r57 & 247 \\ WSO & 112 \\ B374k & 106 \\ NST & 98 \\ NCC & 84 \\ Crystal & 83 \\ \hline \hline \end{tabular}
\end{table}
Table 1: The final clustering results of 1056 web shells, which are based on a clustering threshold of 30%.  
2 Syntactic features.  
Syntactic features refer to the expressions used by attackers when writing web shell scripts. Before the attacker uploads the web shell, they cannot clearly know the detailed configuration information of the corresponding platform, such as which services are opened by the web server and what the password corresponding to a certain mailbox is. This requires the corresponding web shell to automatically adapt to various operating systems and automatically try to obtain the permissions of related software. For this, the following types of syntactic features are considered.  
* The proportion of conditional statements, which represents the percentage of conditional statements in all statements in the script, including if (F7), elseif (F8), else (F9), and case (F10).
* The proportion of looping statements, which represents the percentage of loop statements in all statements in the script, including for (F11), while (F12), and foreach (F13).  
(3) Abstract features.  
Abstract features represent other relevant features besides lexical features and syntactic features. The most important part is the sensitivity function matching degree, which represents the usage of some keywords in the PHP language, such as the disguise execution function (eval), the file acquisition function (wget, curl, lynx, get, fetch), the reverse connection function (perl, python, gcc, chmod, nohup, nc), and the information collection function (uname, id, ver, systcl, whoami, $OSTYPE, pwd). These keywords are often used by attackers in web shells to perform some suspicious behavior. This paper considers the existence of the following four functions as abstract features: disguise execution function (F14), file acquisition function (F15), reverse connection function (F16), and information collection function (F17).  
In addition, three common features of the maximum length of words in the script (F18), the maximum length of lines in the PHP source code (F19), and information entropy (F20) are also added [35].  
In summary, a total of 20 features related to web shell judgment were obtained through feature extraction.