Mitigating Webshell Attacks through Machine Learning Techniques A webshell is a command execution environment in the form of web pages. It is often used by attackers as a backdoor tool for web server operations. Accurately detecting webshells is of great significance to web server protection. Most security products detect webshells based on featurematching methodsxe2x80x94matching input scripts against prebuilt malicious code collections. The featurematching method has a low detection rate for obfuscated webshells. However, with the help of machine learning algorithms, webshells can be detected more efficiently and accurately. In this paper, we propose a new PHP webshell detection model, the NBOpcode (naive Bayes and opcode sequence) model, which is a combination of naive Bayes classifiers and opcode sequences. Through experiments and analysis on a large number of samples, the experimental results show that the proposed method could effectively detect a range of webshells. Compared with the traditional webshell detection methods, this method improves the efficiency and accuracy of webshell detection.

Victim or Attacker? A Multidataset Domain Classification of Phishing Attacks In xe2x80x9cphishing attacksxe2x80x9d, phishing websites disguised as trustworthy websites attempt to steal sensitive information from end users. Remediation options differ depending on whether the phishing website is hosted on a legitimate but compromised domain, in which case the domain owner is also a victim, or whether the domain itself is maliciously registered by an attacker. We propose here a novel machinelearning domain classifier, introducing features based on the internet presence and history of a domain, using only publicly available information. Using a phish feed and malicious domain feed from the AntiPhishing Working Group (APWG), evaluation of our domain classifier achieves 94% accuracy on future malicious domains, while maintaining 88% and 92% accuracy on malicious and compromised datasets respectively from two other sources. To increase our training set we introduce a semisupervised technique to label part of APWGu0027s phish feed. For the rest of the feed we use our classifier and show that 62% of the websites hosting attacks are compromised while the remaining 38% belong to the attackers. The result of this research is a tool which gives some important insights on phisheru0027s current modus operandi. It also provides a quick mechanism, entirely based on freely available data, to assess crucial information about the server and better respond to an attack by having it taken down as quickly as possible.