Webshell Detection Based on Executable Data Characteristics of PHP Code

Table 1

Opcode sequence.

No.	Opcode
0	FETCH CONSTANT
1	FETCH R
2	FETCH DIM R
3	INCLUDE OR EVAL
4	RETURN