# Mdpi
## 4 Threats
### Obfuscated Webshell
The experiment selected 500 webshell samples and 1200 normal samples as data sources. The opcode sequence was the same, regardless of whether of not the webshell was obfuscated, ensuring we could detect both obfuscated and non-obfuscated webshells. Among these 500 samples, 422 webshells could not be detected in the webshell detection tools that feature malicious code matching, which means these samples were obfuscated by attackers. The data set was divided into two parts, with an allocation ratio of 3:7. Thirty percent of the dataset was used to construct a text classifier for the PHP opcode sequence, and the rest was used to train and test the naive Bayes (_NB_) model. Figure 4: The webshell attack flowchart. Table 3 summarizes all possible situations considered in our experiments. A true positive (TP) is a prediction that the current page is a webshell, when it is in fact a webshell. A false negative (FN) is a prediction that the current page is _not_ a webshell, when it actually is. A false positive (FP) is a prediction that the current page is a webshell, though it is actually not. A true negative (TN) is a prediction that the current page is not a webshell, and indeed it is not. Four criteria were used to evaluate webshell effectiveness. As shown in Equation (1), the precision rate refers to the correct prediction of the normal PHP page in the actual sample. The ratio of all normal PHP pages is measured by the ability of the detection model to identify normal PHP pages. \[\text{Precision }=\frac{TP}{TP+FP} \tag{1}\]

The accuracy (Equation (2)) is the most common evaluation indicator, and is the number of correctly identified samples divided by all the samples. Generally speaking, the higher the accuracy, the better the classifier. \[\text{Accuracy}=\frac{TP+TN}{TP+FN+FP+TN} \tag{2}\]

The recall rate (Equation (3)) is the correct prediction of the number of webshells as a percentage of all webshells in the actual sample, measured by the detection model's ability to recognize a webshell. \[\text{Recall}=\frac{TP}{TP+FN} \tag{3}\]

Finally, the F1 score (Equation (4)) is the comprehensive evaluation. The larger the value, the better the detection performance. The higher the precision rate and recall rate, the better the detection capability of the representative model. \[F1=\frac{2*\text{Precision }*\text{Recall}}{\text{Precision }+\text{Recall}} \tag{4}\] \begin{table}
\begin{tabular}{l} \hline \hline
**URL to the Sample Resource** \\ \hline [[https://github.com/ysrc/webshell-sample](https://github.com/ysrc/webshell-sample)]([https://github.com/ysrc/webshell-sample](https://github.com/ysrc/webshell-sample)) \\ \hline [[https://github.com/tennc/webshell](https://github.com/tennc/webshell)]([https://github.com/tennc/webshell](https://github.com/tennc/webshell)) \\ \hline [[https://github.com/xl?dev/WebShell](https://github.com/xl?dev/WebShell)]([https://github.com/xl?dev/WebShell](https://github.com/xl?dev/WebShell)) \\ \hline [[https://github.com/tdfg/WebShell](https://github.com/tdfg/WebShell)]([https://github.com/tdfg/WebShell](https://github.com/tdfg/WebShell)) \\ \hline [[https://github.com/malwares/WebShell](https://github.com/malwares/WebShell)]([https://github.com/malwares/WebShell](https://github.com/malwares/WebShell)) \\ \hline [[https://github.com/xypiie/WebShell](https://github.com/xypiie/WebShell)]([https://github.com/xypiie/WebShell](https://github.com/xypiie/WebShell)) \\ \hline [[https://github.com/testsecer/WebShell](https://github.com/testsecer/WebShell)]([https://github.com/testsecer/WebShell](https://github.com/testsecer/WebShell)) \\ \hline [[https://github.com/BlackArch/webshells](https://github.com/BlackArch/webshells)]([https://github.com/BlackArch/webshells](https://github.com/BlackArch/webshells)) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Webshell sample sources.