# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
13.$a=dynamic();
14.$b=$5a;
15.$c=newassert();
16.$c($b|'x');
17.?>  
(a) User-definedfunction-type (Webshell-1)  
1.<?php
2.include(\"../eval.php\");
3.helloworld($_POST{'hello'});
4.?>  
(b) Include-type (Webshell-2)  
1.<?php
2.functionhelloworld($a){
3.eval($a);
4.}
5.?>  
(c) eval.phpincluded
```
**Listing 5**. The validating sample code.

For the detection of the sample webshells, it can be observed from the experimental results that both samples could be detected by WTA, indicating that WTA can detect the user-defined function-type webshells and include-type webshells. For the other tools, only D-Shield could detect webshell-1 and report it as suspicious at Level 1 (D-Shield detects webshells on a scale of five, with Level 1 being the least dangerous). D-Shield judged it as a Level-1 webshell because it detected variable function [40]\(\xi c(\$b|^{\prime}x^{\prime}|)\). This shows that the performance of the regular matching detection method adopted by the current detection tools is weak at interprocedural analysis, especially for include-type webshells. WTA and WTA-NO-IAM are used to detect the webshell dataset, and the test results are shown in $a=\"_POST\";
4.return$0 \begin{table}
\begin{tabular}{c c c} \hline \hline
**Webshell Detection Tool** & **Webshell-1** & **Webshell-2** \\ \hline WTA (Webshell Taint Analysis) & ✓ & ✓ \\ WTA-NO-IAM (No Interprocedural Analysis Module) & \(\times\) & \(\times\) \\ D-Shield & ✓ (level 1) & \(\times\) \\ SHELLPUB & \(\times\) & \(\times\) \\ WebshellKiller & \(\times\) & \(\times\) \\ WebshellKiller & \(\times\) & \(\times\) \\ CloudWalker & \(\times\) & \(\times\) \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Interprocedural analysis of the test code experiment effect. For the controlled experiment of WTA and WTA-NO-IAM, the recall rate of WTA was 96.4%, while the recall rate of WTA-NO-IAM was only 74.6%. Therefore, the interprocedural analysis module of WTA plays a crucial role in the detection of webshell samples. To sum up, the answer to RQ1 is obvious. The interprocedural analysis module based on taint analysis is effective at the detection of user-defined function-type webshells and include-type webshells. The Validity Test of the Webshell Detection Method Based on Taint Analysis against Unknown Webshells (RQ2)

At present, the mainstream webshell detection tools mostly use the detection method based on regular matching. By capturing the webshells in the wild, the corresponding features are extracted and added into the feature library. Therefore, the webshells that have been spread on the network for a period of time are easier to detect. Moreover, this method of blacklist matching is easy to bypass. How to improve the detection ability against unknown webshells is a goal pursued by various webshell detection tools. To evaluate the effectiveness of this detection method against unknown webshells, we found 5 generation tools that can generate antidetect PHP webshells randomly and used each tool to generate 10 webshells, respectively. Therefore, there was a total of 50 samples. The information on the 5 webshell generation tools is shown in Table 8.

Listing 6 shows the code snippet of pureqh. There are many anchors for replacement in the code, such as {1}, {6}, {7}. These anchor will be replaced with random strings when pureqh runs. Therefore, the webshell was generated each time with different hash values. It is difficult for current static detection tools to extract the features, resulting in detection failure. The popular webshell detection tools mentioned in Table 8 were used to detect the 50 samples, and the detection results are shown in Table 9.

From the experimental results, it can be observed that WTA had an excellent detection effect for the randomly generated unknown webshells. All 50 samples could be detected, and the recall rate reached 100%. Since WTA adopts the taint analysis method for detection, there was no need to extract the corresponding features, and the detection effect was better for unknown webshells.