WTA: A Static Taint Analysis Framework for PHP Webshell
Source abstract
Abstract
Webshells are a malicious scripts that can remotely control a webserver to execute arbitrary commands, steal sensitive files, and further invade the internal network. Existing webshell detection methods, such as using pattern matching for webshell detection, can be easily bypassed by attackers using the file include and user-defined functions. Furthermore, detecting unknown webshells has always been a problem in the field of webshell detection. In this paper, we propose a static webshell detection method based on taint analysis, which realizes accurate taint analysis based on ZendVM. We first converted the PHP code into Opline sequences, analyzed the Opline sequences in order, and marked the externally imported taint source. Then, the propagation of the taint variables was tracked, and the interprocedural analysis of the taint variables was performed. Finally, considering the dangerous functions’ call and the referencing of the taint variables at the point of the taint sink, we completed the webshell judgment. Based on this method, we constructed a taint analysis prototype system named WTA and evaluated it with a benchmark dataset by comparing its performance with popular webshell detection tools. The results showed that our method supports interprocedural analysis and has the ability to detect unknown webshells and that WTA’s performance surpasses well-known webshell detection tools such as D-shield, SHELLPUB, WebshellKiller, CloudWalker, ClamAV, LoKi, and findbot.pl.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Spam and Phishing Detection · Web Application Security Vulnerabilities
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei 230037, China
School of Computer Science and Engineering, Central South University, Changsha 410083, China
Funding
National Key Research and Development Program of China
References (51)
Show source-provided references
1. Developing web applications
2. Microsoft (2021, March 20). Microsoft Defender Advanced Threat Protection. Available online: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.
3. Tu, T.D., Cheng, G., Guo, X., and Pan, W. (2014, January 11–13). Webshell detection techniques in web applications. Proceedings of the Fifth International Conference on Computing, Communications and Networking Technologies (ICCCNT), Hefei, China.
4. Xie, Y., and Aiken, A. (August, January 31). Static Detection of Security Vulnerabilities in Scripting Languages. Proceedings of the 15th USENIX Security Symposium, Vancouver, BC, Canada.
5. Estimates of success rates of remote arbitrary code execution attacks10.1108/09685221211235625 ↗
6. Handling webshell attacks: A systematic mapping and survey10.1016/j.cose.2021.102366 ↗
7. Sun, X., Lu, X., and Dai, H. (2017, January 17–19). A matrix decomposition based webshell detection method. Proceedings of the 2017 International Conference on Cryptography, Security and Privacy, Wuhan, China.10.1145/3058060.3058083 ↗
8. PHP Technology and It’s Application
9. Tian, Y., Wang, J., Zhou, Z., and Zhou, S. (2017, January 8–10). CNN-webshell: Malicious web shell detection with convolutional neural network. Proceedings of the 2017 VI International Conference on Network, Communication and Computing, Kunming, China.10.1145/3171592.3171593 ↗
10. Yong, B., Liu, X., Liu, Y., Yin, H., Huang, L., and Zhou, Q. (2018, January 8–12). Web behavior detection based on deep neural network. Proceedings of the 2018 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computing, Scalable Computing & Communications, Cloud & Big Data Computing, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI), Guangzhou, China.10.1109/SmartWorld.2018.00320 ↗
11. Webshell detection method research based on web log
12. Wu, Y., Sun, Y., Huang, C., Jia, P., and Liu, L. (2019). Session-based webshell detection using machine learning in web logs. Secur. Commun. Netw., 2019.10.1155/2019/3093809 ↗
13. Programming techniques: Regular expression search algorithm10.1145/363347.363387 ↗
14. Pan, Z., Chen, Y., Chen, Y., Shen, Y., and Guo, X. (2021). Webshell Detection Based on Executable Data Characteristics of PHP Code. Wirel. Commun. Mob. Comput., 2021.10.1155/2021/5533963 ↗
15. D-Shield (2021, February 14). D-Shield. Available online: http://www.d99net.net/.
16. Guo, Y., Marco-Gisbert, H., and Keir, P. (2020). Mitigating webshell attacks through machine learning techniques. Future Internet, 12.10.3390/fi12010012 ↗
17. Newsome, J., and Song, D.X. (2005, January 3). Dynamic Taint Analysis for Automatic Detection, Analysis, and SignatureGeneration of Exploits on Commodity Software. Proceedings of the NDSS Symposium 2005, San Diego, CA, USA.
18. Yang, Z., and Yang, M. (2012, January 6–8). Leakminer: Detect information leakage on android with static taint analysis. Proceedings of the 2012 Third World Congress on Software Engineering, Wuhan, China.10.1109/WCSE.2012.26 ↗
19. Dahse, J., and Holz, T. (2014, January 23–26). Simulation of Built-in PHP Features for Precise Static Code Analysis. Proceedings of the NDSS Symposium 2014, San Diego, CA, USA.10.14722/ndss.2014.23262 ↗
20. ShellBreaker: Automatically detecting PHP-based malicious web shells10.1016/j.cose.2019.101595 ↗
21. Fang, Y., Qiu, Y., Liu, L., and Huang, C. (2018, January 12–14). Detecting webshell based on random forest with fasttext. Proceedings of the 2018 International Conference on Computing and Artificial Intelligence, Chengdu, China.10.1145/3194452.3194470 ↗
22. PHP (2021, April 20). PHP: Hypertext Preprocessor. Available online: https://www.php.net/.
23. Zend (2021, April 20). Zend Engine. Available online: https://www.zend.com/.
24. Nikic (2021, January 14). PHP 7 Virtual Machine. Available online: https://www.npopov.com/2017/04/14/PHP-7-Virtual-machine.html.
25. Zend (2021, February 14). How to Use PHP Extensions. Available online: https://www.zend.com/blog/php-development-using-php-extensions.
26. Derickr (2021, January 14). Vulcan Logic Dumper. Available online: https://derickrethans.nl/projects.html#vld.
27. Reps, T. (1994). Solving demand versions of interprocedural analysis problems. Compiler Construction, Springer.10.1007/3-540-57877-3_26 ↗
28. Zhao, Z., Liu, Q., Song, T., Wang, Z., and Wu, X. (2019, January 7–9). WSLD: Detecting Unknown Webshell Using Fuzzy Matching and Deep Learning. Proceedings of the International Conference on Information and Communications Security, Edinburgh, UK.10.1007/978-3-030-41579-2_42 ↗
29. PHP (2021, January 12). Function Reference. Available online: https://www.php.net/manual/en/funcref.php.
30. Day, J., Matta, I., and Mattar, K. (2008, January 9–12). Networking is IPC: A guiding principle to a better internet. Proceedings of the 2008 ACM CoNEXT Conference, Madrid, Spain.10.1145/1544012.1544079 ↗
31. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones10.1145/2619091 ↗
32. Php Internals Book (2021, January 12). PHP Internals Book HASHTABLE API. Available online: https://www.phpinternalsbook.com/php5/hashtables/hashtable_api.html.
33. PHP (2021, January 12). PHP Predefined Variables. Available online: https://www.php.net/manual/en/language.variables.superglobals.php.
34. Shellpub (2021, February 14). Shellpub. Available online: https://www.shellpub.com/.
35. Sangfor (2019, February 14). WebShellkiller. Available online: http://edr.sangfor.com.cn/tool/WebShellKillerTool.zip.
36. Chaitin (2020, February 14). Cloudwalker. Available online: https://github.com/chaitin/cloudwalker/releases/download/webshell-detector-1.0.0/webshell-detector-1.0.0-linux-amd64.10.1142/9789811200076_0001 ↗
37. Cisco-Talos (2021, July 13). Clamav. Available online: https://github.com/Cisco-Talos/clamav/archive/refs/tags/clamav-0.103.3.tar.gz.
38. Neo23x0 (2021, July 12). Loki. Available online: https://github.com/Neo23x0/LoKi/releases/download/0.41.0/loki_0.41.0.zip.
39. CBL (2021, July 12). findbot.pl. Available online: https://www.abuseat.org/findbot.pl.
40. PHP Variable Functions (2021, January 12). PHP. Available online: https://www.php.net/manual/en/functions.variable-functions.php.
41. Robertson, W., Vigna, G., Kruegel, C., and Kemmerer, R.A. (2006, January 2). Using Generalization and Characterization Techniques in the Anomaly-Based Detection of Web Attacks. Proceedings of the NDSS Symposium 2006, San Diego, CA, USA.
42. Kruegel, C., and Vigna, G. (2003, January 27–30). Anomaly detection of web-based attacks. Proceedings of the 10th ACM Conference on Computer and Communications Security, Washington, DC, USA.10.1145/948109.948144 ↗
43. Almgren, M., Debar, H., and Dacier, M. (2000, January 3–4). A Lightweight Tool for Detecting Web Server Attacks. Proceedings of the NDSS Symposium 2000, San Diego, CA, USA.
44. Zhu, T., Weng, Z., Fu, L., and Ruan, L. (2020). A Web Shell Detection Method Based on Multiview Feature Fusion. Appl. Sci., 10.10.3390/app10186274 ↗
45. Evil-hunter: A novel web shell detection systembased on scoring scheme
46. Static Taint Analysis Traversal with Object Oriented Component for Web File Injection Vulnerability Pattern Detection10.1016/j.procs.2018.08.227 ↗
47. Le, V.G., Nguyen, H.T., Pham, D.P., Phung, V.O., and Nguyen, N.H. (2019). GuruWS: A hybrid platform for detecting malicious web shells and web application vulnerabilities. Transactions on Computational Collective Intelligence XXXII, Springer.10.1007/978-3-662-58611-2_5 ↗
48. Le, V.G., Nguyen, H.T., Lu, D.N., and Nguyen, N.H. (2016, January 28–30). A solution for automatically malicious web shell and web application vulnerability detection. Proceedings of the International Conference on Computational Collective Intelligence, Halkidiki, Greece.10.1007/978-3-319-45243-2_34 ↗
49. A method of detecting Webshell based on multi-layer perception
50. Cui, H., Huang, D., Fang, Y., Liu, L., and Huang, C. (2018, January 18–21). Webshell detection based on random forest–gradient boosting decision tree algorithm. Proceedings of the 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC), Guangzhou, China.10.1109/DSC.2018.00030 ↗
51. WS-LSMR: Malicious WebShell Detection Algorithm Based on Ensemble Learning10.1109/ACCESS.2020.2989304 ↗