# Mdpi
## 4 Threats
### Obfuscated Webshell
To extract word frequency features from opcode sequences using a TF-IDF model. 3. To apply different machine learning algorithms to detect this dichotomy problem. The flow chart in Figure 3 is a combination of a machine learning algorithm and an opcode sequence. Firstly, all sample files are extracted from the opcode sequence [26], and the extracted opcode sequence is processed by the TF-IDF model. Then, it is randomly divided into a test set and a training set. The machine learning algorithm is used to generate a classifier. Finally, the test set is predicted and evaluated. As detailed in Section 6, compared with the detection based on the original text, the detection opcode is much more efficient and accurate and the machine learning algorithm overcomes the weaknesses of the traditional detection methods and existing security tools. ### Opcode

Our approach uses PHP opcode sequences as the inputs. The opcode is part of a computer's instructions, also known as its byte-code. The core idea of the approach is to extract the sequence of instructions, such as _add, echo_, and _return_ from the webshell. Since we are using PHP files and the direct use of bag-of-words and TF-IDF for model training of PHP files will consume a lot of computing resources, the use of the opcode model for dimension reduction can effectively improve the efficiency and accuracy of the model. By focusing on the opcodes only, the relevance of operating instructions and not function names is emphasized. The method can thus be employed to effectively detect encrypted and confusing codes. Even to confuse encryption webshell dangerous function, it still can appear at compile time with normal file to compile the results of different opcode statement. So according to this characteristic, using the opcode distinguish webshell and normal files, we can convert file detection to opcode sequence detection [26]. Therefore, compiled byte-code can bypass PHP code that has been obfuscated. In this paper, we use the PHP plug-in logic extension module Vulcan logic dumper (VLD) compiled for PHP opcode files [27]. The example listed below is the output of a webshell opcode sequence:
```
eval($_POST[CMD]); >>
```

If we run the above webshell through VLD, then we can see the opcode output of this PHP code in Table 1. \begin{table}
\begin{tabular}{l l} \hline \# & **OPCODE** \\ \hline
1 & FETCH\_CONSTANT \\
2 & FETCH\_R \\
3 & FETCH\_DIM\_R \\
4 & INCLUDE\_OR\_EVAL \\
5 & RETURN \\ \hline \end{tabular}
\end{table} 
Table 1: Dump of the opcode sequences. Figure 3: Process flow. So, the PHP opcode sequence of the webshell is: \"FETCH_CONSTANT\", \"FETCH_R\", \"FETCH_DIM_R\", \"INCLUDE_OR_EVAL\", \"RETURN\". When training with the machine learning algorithm, we do not need to know the meaning of an opcode sequence. Since we marked the webshell file samples, we only need to classify these opcodes. ### Data Preprocessing

Data preprocessing includes file deduplication and opcode acquisition. In our approach, we use the MD5 value to detect and remove duplicate files. If the MD5 value is the same, the file is considered to be deduplicated. Once we have removed deduplicated files, we use opcodes to detect malicious obfuscated files. Opcode is the intermediate language after PHP script compilation, and its relationship with PHP is analogous to Java virtual machine (JVM) byte-code's relationship to Java. It includes operators, operands, instruction formats and specifications, and data structures that hold instructions and related information. PHP code execution consists of four phases: (1) lexical analysis, (2) syntax parsing, (3) opcode compilation, and (4) opcode execution. The compiler will be in phase 3 and an opcode is bound to the corresponding parameter or function call. Even if the webshell's dangerous function is confusingly obfuscated, there will still be an opcode statement that is different from the normal file compilation result at compile time. Therefore, according to this feature, opcodes can be used to distinguish between webshells and normal files.