Webshell Detection Based on Executable Data Characteristics of PHP Code

Algorithm 1

Executable data characteristic extraction of PHP code.

Input: PHP language samples files

Output: one-dimensional matrix of executable data characteristics of the sample

  1. Convert PHP code to abstract syntax tree, turn to step 2.

  2. Judges whether there are Eval, FuncCall, MethodCall, or ShellExec nodes under Expr nodes in the abstract grammar tree, and if matched, turn to step 3; else, return 0.

  3. Judges whether the functions in the nodes above are functions that can execute the data as PHP code or system commands, such as eval, exec, system, etc. If the answer is yes, turn to step 4; else, return 0.

  4. Judge the type of parameter in the function, whether the parameter is variable. If it is, return 1, if not, return 0.