# Mdpi
## 4 Threats
### Obfuscated Webshell  
One technique employed by attackers is to obfuscate the webshell in order to prevent being analyzed. By obfuscating sensitive features in a string, it can be inversely mapped to another string. This escape technique is widely used in various webshells such as Base64, rot13, and other obfuscation methods [22; 23]. We used the plain webshell in Listing 3 to obfuscate malicious code. The attacker can obfuscate webshell code with tools such as Weevely, an open-source obfuscation tool integrated in KALI [24]. For example, we can obfuscate the first example of a plain webshell using the Weevely tool. From Listing 4 we can see that the tool uses obfuscation methods such as Base64. Next, the attacker only needs to upload the obfuscated webshell code to the victim's web server. Similarly, the attacker can submit a malicious POST request such as \"passwd = system('ls');\". By executing this attack command, the attacker can traverse the victim's web server directory. Because no malicious functions such as \"eval\" or \"assert\" can be observed in the code, the danger of this method is significantly higher than the plaintext webshell in the first section. Traditional detection methods are difficult to apply to such obfuscated webshell code. Therefore, in actual attacks, this attack method is very common. ```
<?php $fo=\"UE9\"; $bp=\"TVF4e\"; $jsh=\"HqhKTSKCG==\"; $un = str_replace(\"b\",\"\",\"bsbtbrb_brbepblbabcbe\"); $bf=\"CkqBldQmFsKCRf\"; $clh = $un(\"y\",\"\",\"ybyshev64y_ydeyeycodye\"); $nbg = $un(\"ev\",\"\",\"evcvereate



### Remote Webshell

To avoid the detection of high-risk functions and parameters used in a single malicious file, a complete page can be divided into multiple pages for uploading. This approach effectively reduces the probability of detecting a webshell by reducing the proportion of dangerous functions or parameters in the _main_ webshell [25].

Program developers typically write reusable functions to a single file, and call this file directly when a function is needed without having to write it again. The process of calling such a file is generally referred to as file inclusion. Because of this flexibility, the client can call a malicious file. An attacker can construct such malicious files for unethical purposes, causing files to contain vulnerabilities.

For example, the webshell could not contain any sign of malicious activities but it could include remote files where the malicious actions are downloaded under demand. If the PHP configuration option \"allow_url_include\" is ON, then the \"include/require\" function can load remote files. This vulnerability is called remote file inclusion (RFI). Victims' web services often use such \"include\" functions to include files, as shown in Listing 6. Consequently, attackers can exploit this vulnerability to upload remote webshells. The attacker just needs to control a public server and embed webshell files. An attacker's proof of concept is shown in Listing 7. If the attacker can successfully access the webshell, they can traverse the victim's directory as previously mentioned.

Since the webshell is stored on the attacker's server, such threats are very difficult to detect.
```
<?php $filename = $_GET['page']; include($filename);?>
```
Listing 6: Remote Webshell Example. ## 5 Proposed Solution

In order to mitigate the threats described in Section 4, we propose a new approach to effectively detect webshells. Our approach is based on machine learning algorithms which use PHP opcode sequences as inputs. The approach takes advantage of machine learning research, proposing a new detection method based on a term frequency-inverse document frequency (TF-IDF) model and naive Bayes algorithms. Since webshell is a text-based scripting language, we can use a natural language model such as TF-IDF to process the webshell. The three main ideas behind the proposal are:

1. To reduce the interference of webshell confusions and encryption operations on the detection. File detection is transformed into the detection of opcode sequences. 2.