# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
** The webshell sample is misidentified as a normal file;

**Accuracy. ** The proportion of correctly predicted samples to all samples. The formula is as follows:

$(7))[1]
2. $6 \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & \begin{tabular}{c} **The Number** \\ **of Webshells** \\ \end{tabular} & **D-Shield** & **SHELLPUB** & \
\begin{tabular}{c} **WebshellKiller** \\ **(Precision)** \\ \end{tabular} & **
\begin{tabular}{c} **WebshellKiller** \\ **(Recall)** \\ \end{tabular} & **CloudWalker** & **WTA** \\ \hline venom & 10 & 10 & 0 & 0 & 0 & 10 \\ weevely & 10 & 10 & 0 & 0 & 10 & 0 \\ b374k & 10 & 10 & 0 & 0 & 10 & 10 \\ aqk & 10 & 10 & 0 & 0 & 0 & 10 \\ ureqh & 10 & 0 & 0 & 0 & 0 & 10 \\ total & 10 & 40 & 0 & 0 & 20 & 10 & 50 \\ Recall & – & 80\% & 0\% & 0\% & 40\% & 20\% & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 9: The detection effect for unknown webshells. **Recall. ** The proportion of correctly predicted webshell samples to the real webshell samples; the higher the recall rate, the better the performance is for potential webshells' detection. The formula is as follows:

\[\text{Recall}=\frac{\text{TP}}{\text{TP + FN}}; \tag{2}\]

**Precision. ** The proportion of correctly predicted webshell samples to the predicted webshell samples; the higher the precision rate, the lower the false positive rate is. The formula is as follows:

\[\text{Precision}=\frac{\text{TP}}{\text{TP + FP}}; \tag{3}\]

**F-measure. ** The F-measure is a comprehensive consideration of recall and precision. Generally, a higher F1 indicates that the experimental method is more effective. The larger \(\beta\) is, the more importance is attached to the recall. The \(\beta\) values used in our experiment were 0.5, 1, and 1.5. The formula is as follows:

\[F_{\beta}=(1+\beta^{2})\frac{\text{Precision}*\text{Recall}}{(\beta^{2}*\text{ Precision})+\text{Recall}}. \tag{4}\]

In the experiment, the method presented in this paper was compared with well-known webshell detection tools, and a controlled experiment was conducted based on the experimental dataset in Section 6.2. The experimental results are shown in Table 10.

The experimental results showed that D-Shield had the best comprehensive performance among the well-known webshell detection tools, whose recall was 90.54%, precision 99.81%, and \(F_{1}\) 94.95%. However, our system WTA had better comprehensive performance than D-Shield, with a recall of 96.45%, which was 5.91% higher than D-Shield, precision 97.71%, slightly lower than D-Shield, but also a high level of precision, and \(F_{1}\) 97.08%, which was 2.13% higher than D-Shield. Obviously, the performance of our method was at the top of all webshell detection tools. It is worth noting that the performance of the two modes in WebshellKiller was quite different, with a precision of 99.77% in precision mode. While some precision was sacrificed in recall mode, the recall was 26.97% higher than precision mode, but still only 77.47%, which is an average performance. SHELLPUB's detection speed was the fastest among all the tools: the detection of webshell samples took less than 10 seconds; however, its recall was too low. CloudWalker applies a number of detection techniques, such as statistical feature detection, AST detection, regular matching, machine learning, etc. Therefore, its detection speed was the slowest, and the average detection time was three-times that of other tools. ### Discussion

In this section, we discuss the limitations and future developments of static webshell detection methods based on taint analysis to improve the integrity of WTA.