# Mdpi
## 4 Threats
### Obfuscated Webshell
\begin{table}
\begin{tabular}{c c c} \hline \hline
**True Class** & \multicolumn{2}{c}{**Predicted Result**} \\ \cline{2-3}  & **Webshell** & **Normal Page** \\ \hline \hline \multicolumn{1}{c}{Webshell} & True Positive (TP) & False Negative (FN) \\ \hline \hline \multicolumn{1}{c}{Normal Page} & False Positive (FP) & True Negative (TN) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Classification confusion matrix. ### Impact of Max_Features Value on Results

With 500 webshell samples and 1200 normal samples, we set the ngram_range value to (2,2), and other parameters were unchanged. When setting max_features to 1000, 2500, 5000, 7500, 10,000, 12,500, 17,500, 20,000, 40,000, and 50,000, respectively, we calculated the accuracy rate and recall rate. Figure 5 shows the result of different features. It can be concluded from the experimental results that the larger the value of max_features, the higher the accuracy and recall, but it was not an unlimited increase. When the value was more than 40,000, the accuracy rate and recall rate had already reached the highest value. Therefore, we chose the value of 50,000 in the experiment. ### Effectiveness of the Approach

To assess the effectiveness of the proposed approach, we compare the accuracy, precision recall and F1-score of our naive Bayes and opcode sequence (NB-Opcode) webshell detection method, against SVM and RF approaches. Table 4 shows the result of comparing NB-Opcode against the methods used by SVM and RF. The detection methods based on naive Bayes and Opcode sequences are superior to the other two algorithms in terms of accuracy, precision, recall rate and performance; in terms of F1 values. In order to provide a complete evaluation of the NB-Opcode approach, a comparison against real tools is provided. We again used the previous training data to test and compare three popular webshell detection tools: D-Shield, Webshell Killer, and Web Shell Detector. These three tools support PHP code \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Method** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score (\%)** \\ \hline NB-Opcode & 97.4 & 97.2 & 96.8 & 97.0 \\ \hline SVM & 96.0 & 94.1 & 95.9 & 95.9 \\ \hline RF & 96.1 & 89.0 & 88.2 & 88.6 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Accuracy, precision, recall, and performance comparison. NB: naïve Bayes; RF: random forest; SVM: support vector machine. Figure 5: Impact of max_features value. upload detection. After uploading a webshell to determine the effectiveness of these three tools, we observed a lower detection rate compared with the proposed NB-Opcode approach. In addition, unlike the NB-Opcode, none of the three detection tools analyzed use the opcode sequence, which ensures that the detection of obfuscated webshells is almost impossible. Table 5 summarizes the comparison of the NB-Opcodemethod against the three available products in detecting webshells. It can be seen from the data in the table that NB-Opcode-based detection method was superior to the other three detection tools. ## 7 Conclusions and Future Work

This paper analyzes the definition and classification of webshells in detail and describes the characteristics of webshells. Based on this, a webshell detection method based on a naive Bayes algorithm and opcode sequence is proposed. The support vector machine and random forest algorithm detection methods were compared with respect to four aspects: accuracy, precision, recall rate, and F1 value. The experimental results show that the proposed method had higher indexes in webshell detection. We also compared three popular webshell detection tools (Webshell Killer, D-Shield, and Web Shell Detector). Most of the existing security tools are based on feature matching. The experimental results show that the detection rate of this method compares favorably against these established security tools.