# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
The method of statistical characteristics summarizes the characteristics of an entire webshell file according to the attribute values of certain aspects of the file. Due to the rapid development of web services, developers tend to use encryption and obtrusion techniques to avoid source code leakage, which leads to the statistical characteristics of normal files being similar to that of the webshell files. Therefore, a webshell detection method based on statistical characteristics loses its original advantages. [PERSON] et al. [14] proposed a webshell detection method based on executable data features in PHP code. This method combines the characteristics of executable data from the PHP code with the characteristics of the static text to detect webshells. Compared to the traditional static statistical method, this method can improve the recognition ability. Webshell detection systems will use different classification methods to determine whether a suspicious file is a webshell. For example, the webshell detection method proposed by [PERSON] et al. [49] uses a multilayer neural network to detect and classify suspicious files. [PERSON] et al. [50] used the combination of a random forest classifier and a GBDT classifier for classification. [PERSON] et al. [21] used the fastText algorithm to train the Opcode sequence model and predicted the corresponding features of the samples. Finally, random forest was used to realize the binary classification. Each of these methods has its advantages and disadvantages. [PERSON] et al. [51] proposed a webshell detection method based on ensemble learning, which constructed a differentiated ensemble detection model, WSLSMR, composed of Logistic Regression (LR), Support Vector Machine (SVM), Multilayer Perceptron (MLP), and Random Forest (RF). Given the four basic classifiers (LR, SVC, MLP, RF), this model adaptively assigns weights to the four classifiers, and algorithms with high accuracy will have high weights to better reflect the effect of good algorithms. ## 8 Conclusions

Webshells are an important threat to network security. Attackers using a webshell can invade websites, control servers, steal sensitive files, and further invade the internal network. How to improve the capability of interprocedural analysis and improve the detection ability for unknown webshells are the main challenges of webshell detection. This paper proposed a webshell static detection method based on taint analysis. For the first time, we constructed a set of user-defined taint propagation rules and a set of user-defined taint sink rules for the unique instruction set of the ZendVM. A PHP webshell detection method was formed by the combination of the two sets of rules and the detection of the Opline taint source. Based on this method, we implemented a static taint analysis prototype system named WTA for the detection of PHP webshells. Experimental results showed that WTA supports interprocedural analysis and has the ability to detect unknown webshells. Compared with the current popular webshell detection tools, WTA can detect more webshells. Its recall rate reached 96.45%, which was 5.91% higher than the best-performing tool among the other tools. The precision rate was 97.71%, and the \(F_{1}\) was 97.08%. Conceptualization, Y.L. and J.Z. ; methodology, J.Z., X.W. and K.Z. ; software, J.Z. and L.Y. ; validation, J.Z. and X.W. ; investigation, J.Z. ; resources, Y.L. ; data curation, J.Z. and X.W. ; writing--original draft preparation, J.Z. ; writing--review and editing, Y.L., K.Z., L.Y. and J.Z. ; supervision, Y.L. ; project administration, Y.L. All authors read and agreed to the published version of the manuscript. This research was supported by the National Key Research and Development Project of China (No. 2017 YFB0802900). Not applicable. We would like to sincerely thank the reviewers for their insightful comments, which helped us improve this work. The authors declare no conflict of interest. ## References

* [PERSON] (2011) [PERSON] Developing web applications. _Int. J. Softw. Eng.