# A Web Shell Detection Method Based on Multiview Feature Fusion
## 4 Evaluation
### The Experiment of Feature Selection  
In this paper, the Fisher score is used for feature selection. Before feature selection, all types of features are normalized to the interval of 0-1 to eliminate the impact between different dimensions. In this paper, the min-max normalization method is used, as follows, in Equation (2), where the \(Z_{i}\) is the normalized result, \(F_{\text{max}}\) is the maximum data of the target feature, and \(F_{\text{min}}\) is the minimum data of the target feature, respectively. \[Z_{i}=\frac{F_{i}-F_{\text{min}}}{F_{\text{max}}-F_{\text{min}}} \tag{2}\]  
For each type of normalized feature, the value of the Fisher score and the final classification accuracy (the ratio of the number of samples in the training set to that in the test set is 32.) is calculated. The relationship between the Fisher Score and the feature's impact on the final classification accuracy for all features is shown in Figure 2.  
It can be seen from Figure 2 that if a certain feature does not represent the user's unique behavior well, then its Fisher score will be close to 0, and the accuracy when using this feature for classification alone will become very low. Conversely, if a feature is very representative, then its Fisher score will be much greater than 0, and the accuracy when using this feature for classification alone will become better. By comparison, it is found that the most important features include four types of functions (i.e., disguise execution function, file acquisition function, reverse connection function, and information collection function) and various highly parameterized global variables (i.e., $_GET, $_POST, and $_COOKIE), while the useless features are \"if\" and \"else\" in the conditional sentences. We also use SVM to demonstrate the effect of the number of selected features. The best parameters of SVM are adopted here (C = 0.8 and \(\gamma\) = 0.03, which are described in Section 4.4). The radial basis function (RBF) kernel is chosen in the experiment. The ratio of the number of samples in the training set  
Figure 2: The relationship between the Fisher score and the feature’s impact on the final classification accuracy for all features. to that in the test set is 3:2 (in particular, 60% samples from each web shell family are selected randomly as malicious ones; similar methods are used to select benign samples). Each result is based on 100 independently repeated trials. Figure 3 shows the accuracy results by extracting different features through SVM. It was observed that the classification accuracy of the SVM classifier achieved 92.1% when the top 16 ranked features were selected by the Fisher score method. It was found that when the number of selected features was smaller than 16, the final accuracy increased as the number increased, and when the number of selected features was larger than 16, the final accuracy decreased as the number increased. Finally, the top 16 ranked features were chosen for our web shell detection. To further investigate the effectiveness of feature selection, the Fisher score method was evaluated by adopting different ratios of training and testing sets. The proportions of the training set are 20%, 30%, 40%, 50%, 60%, and 70% (in particular, samples of the above ratio from each web shell family were randomly selected as malicious samples). After determining the size of the training set, the remaining data were used for testing. In order to eliminate accidental factors, 100 independent trials were carried out for different ratios. Figure 4 depicts the relationship between different percentages of samples for training and classification accuracy. It was observed that classification accuracy with the Fisher score feature selection was better than that without feature selection. In Figure 4, when the training percentage was selected as 20%, the classification accuracy was less than 80%, which demonstrated that our SVM model (the experiment of SVM training is discussed in Section 4.4) was not well trained.