【摘要】 Webshell是一种网站后门程序，常被黑客用于入侵服务器后对服务器进行控制，给网站带来严重的安全隐患。针对以往基于流量的机器学习检测Webshell方法存在特征选择不全、向量化不准确、模型设计不合理导致的检测效果不佳问题，设计并实现了一种将基于变换器的双向编码器表示技术（BERT）与卷积神经网络（CNN）相结合的Webshell流量检测系统，通过分析超文本传输协议（HTTP）报文中各个字段信息，提取其中具有Webshell信息的特征字段，使用BERT模型对特征进行向量化编码，并结合一维CNN模型从不同空间维度检测特征建立分类模型，最后使用模型对流量数据进行检测调优。实验结果表明，与以往基于流量检测方法相比，该检测系统在准确率、召回率和F1值等性能指标上表现更好，分别达到99.84%、99.83%、99.84%。更多还原

【Abstract】 Webshell is a website backdoor program, which is often used by hackers to control the server after invading the server, bringing serious security risks to the website. Aiming at the problems of incomplete feature selection, inaccurate vectorization, and unreasonable model design in the previous Webshell methods for traffic-based machine learning detection, a Webshell traffic detection system was designed and implemented by combining Bidirectional Encoder Representations from Transformers(BERT) with Convolutional Neural Network(CNN). By analyzing the information of different fields in the HyperText Transfer Protocol(HTTP) message, the feature fields with Webshell information were extracted, the BERT model was used to vectorize the features, and a one-dimensional CNN model was combined to detect features from different spatial dimensions to establish a classification model. Finally the model was used to detect and optimize the traffic data according to the classification result. Experimental results show that, compared with other traffic based detection methods proposed in previous studies, the detection system designed in this paper performs better on the performance indicators such as accuracy, recall, and F1 values, reaching 99. 84%, 99. 83% and 99. 84%, respectively.更多还原