Webshell Detection Based on Executable Data Characteristics of PHP Code

Table 2

The corpus fragments generated by N =3.

#	Corpus fragments
0	[‘ASSIGN’, ‘INCLUDE_OR_EVAL’, ‘CONCAT’]
1	[‘ASSIGN’, ‘INIT_FCALL’, ‘SEND_VAL’]
2	[‘CONCAT’, ‘INCLUDE_OR_EVAL’, ‘RETURN’]
3	[‘DO_ICALL’, ‘CONCAT’, ‘INCLUDE_OR_EVAL’]
4	[‘INCLUDE_OR_EVAL’, ‘CONCAT’, ‘INCLUDE_OR_EVAL’]
5	[‘INIT_FCALL’, ‘SEND_VAL’, ‘DO_ICALL’]
6	[‘SEND_VAL’, ‘DO_ICALL’, ‘CONCAT’]