# Mdpi
## 4 Threats
### Obfuscated Webshell
To convert the detection of the file into the detection of the opcode sequence, we use the PHP plug-in logic dumper (VLD) to compile the PHP file opcode. ### Feature Extraction and Representation

Machine learning algorithms cannot be directly applied to text; it is necessary to convert the opcode feature vector obtained in Section 5.2 to a mathematical form that the algorithm can handle. Since the object of this proposal is a static PHP file, it will be based on opcodes. To extract the word frequency, word bag and TF-IDF models are used. ### Word Bag and TF-IDF Models

The word bag model is a feature extraction model applied to the natural language processing (NLP) domain that does not consider lexical, grammatical, or word-order relationships. A document can be seen as a bag of independent words, where a dictionary based on words is built, and the document is represented as a vector based on a dictionary. The model assumes that there is a collection of documents \(D\) containing normal files and webshell files with a total of \(M\) documents. All the words in the document are then extracted to form a dictionary containing \(N\) opcode words (\(N\) can be selected according to the actual situation). Each document is then represented as an \(N\) -dimensional vector using a dictionary, and the value of each dimension of the vector represents the number of times the word appears in the document. With this method, each word or token is called a \"gram\", and a vocabulary of word pairs is a \"bi-gram\". This method counts the frequency of occurrence of all grammars and forms a list of key grammars. Each gram in the list is a feature vector dimension. The model is based on the assumption that the appearance of the \(N\)th word is only related to the first \(N-1\) words, and not related to any other words. The probability of the entire sentence occurring is the product of the probability of each word. These probabilities can be obtained directly by counting the number of simultaneous occurrences of \(N\) words from the corpus. For Figure 4, we can tokenize opcode sequences by a 2-gram model. However, the frequency of words alone cannot reflect their importance. To find the opcode words that can better summarize the features and distinguish between normal files and webshell, this paper introduces TF-IDF for further processing after the word-bag model processing. The TF-IDF algorithm uses the inverse document frequency of the word to correct the word eigenvalues expressed only by word frequency, based on the TF-IDF value of the word. Words with less distinguishing ability are filtered out, while important words are retained. ### Model Training and Validation

Firstly, we traverse all webshell samples and normal samples, and obtain opcode sequences through VLD, marking the opcode of the webshell file as 1, and the opcode of the normal file as 0. We then use 2-gram and TF-IDF models to process opcode data and format them into matrix form, before dividing them randomly into training sets and test sets. The TF-IDF scheme is used to calculate the weight of each 2-gram opcode in the entire sequence and obtain the processed numerical matrix. The higher the TF-IDF score, the more important the opcode feature is. The machine learning algorithm is applied to the training set to obtain the corresponding model data, using the model data to make predictions on the test set. Later, the prediction effect is verified. The algorithm is instantiated and the data is trained on the training set to predict the test set. ## 6 Evaluation

In this section we evaluate the effectiveness of the new proposed method to detect webshells and malicious files. We describe the bases of the experiments and later we assess the effectiveness of the proposed approach. ### Experiments

For our experiments we obtained webshell samples from public Github repositories. Some of them are listed in Table 2. Normal PHP files were collected from open-source PHP projects, including WordPress, PHP CMS, phpMyAdmin, Smarty, and Yii.