# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
Among the well-known webshell detection tools, only D-Shield, WebshellKiller (recall mode), and CloudWalker could find the webshells. D-Shield could detect 40 webshells, but could not detect webshells generated by pureqh. WebshellKiller (recall mode) could only detect the samples generated by weevely and b374k; other samples could not be detected. CloudWalker could only find 10 webshells. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Webshell Detection Tool** & **TP** & **FN** & **Recall** \\ \hline WTA(Webshell Taint Analysis) & 1713 & 63 & 0.964527027 \\ WTA-NO-IAM(no interprocedural analysis module) & 1325 & 451 & 0.746058558 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Performance comparison between WTA and WTA-NO-IAM. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Tool** & **Source** & **Last Update** \\ \hline pureqh & [[https://github.com/pureqh/webshell](https://github.com/pureqh/webshell)]([https://github.com/pureqh/webshell](https://github.com/pureqh/webshell)) & 12 February 2021 \\ venom & [[https://github.com/0x6b7966/webshell-venom](https://github.com/0x6b7966/webshell-venom)]([https://github.com/0x6b7966/webshell-venom](https://github.com/0x6b7966/webshell-venom)) & 2 July 2019 \\ weevely & [[https://github.com/epinna/weevely3](https://github.com/epinna/weevely3)]([https://github.com/epinna/weevely3](https://github.com/epinna/weevely3)) & 8 August 2020 \\ b374k & [[https://github.com/b374k/b374k](https://github.com/b374k/b374k)]([https://github.com/b374k/b374k](https://github.com/b374k/b374k)) & 13 December 2016 \\ aqk & [[https://www.anquanke.com/post/id/193042](https://www.anquanke.com/post/id/193042)]([https://www.anquanke.com/post/id/193042](https://www.anquanke.com/post/id/193042)) & 21 November 2019 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: The sources of the antidetect webshell generation tools. ```
1.function[6]($(7))[1]
2. $BASES32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
3. $[8] = ';';
4. $v = 0;
5. $vbits = 0;
6. for ($i = 0, $j = strlen($[7]); $i < $j; $i++)[1]
7. $v <<= 8;
8. $v += ord($[7][$i]);
9. $vbits += 8;
10. while ($vbits >= 5) [1]
11. $vbits = 5;
12. $(7))[1]
2. $0v >> $(7))[1]
2. $1v &= ((1 << $(7))[1]
2. $2vbits > 0)[1]
15. $(7))[1]
2. $3vbits);
16. $(7))[1]
2. $4v];[4]
17. return$(7))[1]
2. $5
```

Listing 6: The validating sample code. It is worth mentioning that D-Shield's detection report stated that the 40 samples were \"known webshells\", indicating that D-Shield only noticed the four generation tools and added their features to their webshell feature library. The updated time of these tools is also a good indication of this viewpoint. The detected webshells were all generated by tools updated before 2021. The oldest tool, b374k, was last updated on 13 December 2016. As for the webshells generated by the latest tool pureqh, D-Shield could not detect them, while our WTA based on taint analysis could achieve a better detection effect for unknown webshells. To sum up, the answer to RQ2 is evident. The webshell detection method based on taint analysis has a better effect against unknown webshells and can provide important help for detecting webshells. ### WTA and Well-Known Webshell Detection Tools for Performance Comparison (RQ3)

The above two experiments evaluated the effectiveness of the two key techniques in this paper. The experiment in this section evaluated the overall performance of the system and whether the method presented in this paper can improve the performance of webshell detection. In order to better evaluate the performance of webshell detection tools, the evaluation indicators of this experiment are defined as follows:

We regarded webshells as positive samples and normal files as negative samples;

**True Positive (TP). ** The webshell sample is correctly recognized as a webshell;

**False positive (FP). ** The normal file is misidentified as a webshell;

**True Negative (TN). ** The normal file is correctly recognized as a normal file;

**False Negative (FN).