{"id":"https://openalex.org/W7090347496","doi":"https://doi.org/10.1007/s44443-025-00235-8","title":"Incremental learning research for webshell detection","display_name":"Incremental learning research for webshell detection","publication_year":2025,"publication_date":"2025-10-01","ids":{"openalex":"https://openalex.org/W7090347496","doi":"https://doi.org/10.1007/s44443-025-00235-8"},"language":"en","primary_location":{"id":"doi:10.1007/s44443-025-00235-8","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s44443-025-00235-8","pdf_url":"https://link.springer.com/content/pdf/10.1007/s44443-025-00235-8.pdf","source":{"id":"https://openalex.org/S2764955546","display_name":"Journal of King Saud University - Computer and Information Sciences","issn_l":"1319-1578","issn":["1319-1578","2213-1248"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of King Saud University Computer and Information Sciences","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://link.springer.com/content/pdf/10.1007/s44443-025-00235-8.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Zhiqiang Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I202334528","display_name":"Beijing Electronic Science and Technology Institute","ror":"https://ror.org/01xdzh226","country_code":"CN","type":"education","lineage":["https://openalex.org/I202334528"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Zhiqiang Wang","raw_affiliation_strings":["Beijing Electronic Science and Technology Institute, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Electronic Science and Technology Institute, Beijing, China","institution_ids":["https://openalex.org/I202334528"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Haoyu Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I202334528","display_name":"Beijing Electronic Science and Technology Institute","ror":"https://ror.org/01xdzh226","country_code":"CN","type":"education","lineage":["https://openalex.org/I202334528"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haoyu Wang","raw_affiliation_strings":["Beijing Electronic Science and Technology Institute, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Electronic Science and Technology Institute, Beijing, China","institution_ids":["https://openalex.org/I202334528"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Shaowei Yuan","orcid":null},"institutions":[{"id":"https://openalex.org/I202334528","display_name":"Beijing Electronic Science and Technology Institute","ror":"https://ror.org/01xdzh226","country_code":"CN","type":"education","lineage":["https://openalex.org/I202334528"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shaowei Yuan","raw_affiliation_strings":["Beijing Electronic Science and Technology Institute, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Electronic Science and Technology Institute, Beijing, China","institution_ids":["https://openalex.org/I202334528"]}]},{"author_position":"last","author":{"id":null,"display_name":"Zhiang Tian","orcid":null},"institutions":[{"id":"https://openalex.org/I202334528","display_name":"Beijing Electronic Science and Technology Institute","ror":"https://ror.org/01xdzh226","country_code":"CN","type":"education","lineage":["https://openalex.org/I202334528"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiang Tian","raw_affiliation_strings":["Beijing Electronic Science and Technology Institute, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Beijing Electronic Science and Technology Institute, Beijing, China","institution_ids":["https://openalex.org/I202334528"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I202334528"],"apc_list":{"value":1350,"currency":"USD","value_usd":1350},"apc_paid":{"value":1350,"currency":"USD","value_usd":1350},"fwci":2.5663,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.92526622,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":"37","issue":"8","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T13537","display_name":"German legal, social, and political studies","score":0.04800000041723251,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T13537","display_name":"German legal, social, and political studies","score":0.04800000041723251,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10259","display_name":"Sociology and Education Studies","score":0.03150000050663948,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T13212","display_name":"German Social Sciences and History","score":0.02449999935925007,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/opcode","display_name":"Opcode","score":0.8978999853134155},{"id":"https://openalex.org/keywords/incremental-learning","display_name":"Incremental learning","score":0.524399995803833},{"id":"https://openalex.org/keywords/sliding-window-protocol","display_name":"Sliding window protocol","score":0.42640000581741333},{"id":"https://openalex.org/keywords/joint","display_name":"Joint (building)","score":0.4171999990940094},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.4083999991416931},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.38350000977516174},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.37450000643730164},{"id":"https://openalex.org/keywords/forgetting","display_name":"Forgetting","score":0.37369999289512634},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.37070000171661377}],"concepts":[{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.8978999853134155},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7889000177383423},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6625000238418579},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5598999857902527},{"id":"https://openalex.org/C2780735816","wikidata":"https://www.wikidata.org/wiki/Q28324931","display_name":"Incremental learning","level":2,"score":0.524399995803833},{"id":"https://openalex.org/C102392041","wikidata":"https://www.wikidata.org/wiki/Q592860","display_name":"Sliding window protocol","level":3,"score":0.42640000581741333},{"id":"https://openalex.org/C18555067","wikidata":"https://www.wikidata.org/wiki/Q8375051","display_name":"Joint (building)","level":2,"score":0.4171999990940094},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4083999991416931},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.38350000977516174},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.37450000643730164},{"id":"https://openalex.org/C7149132","wikidata":"https://www.wikidata.org/wiki/Q1377840","display_name":"Forgetting","level":2,"score":0.37369999289512634},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.37070000171661377},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.364300012588501},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3571999967098236},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.352400004863739},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3425000011920929},{"id":"https://openalex.org/C22367795","wikidata":"https://www.wikidata.org/wiki/Q7625208","display_name":"Structured prediction","level":2,"score":0.33629998564720154},{"id":"https://openalex.org/C148524875","wikidata":"https://www.wikidata.org/wiki/Q6975395","display_name":"F1 score","level":2,"score":0.32519999146461487},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.3160000145435333},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3107999861240387},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C28006648","wikidata":"https://www.wikidata.org/wiki/Q6934509","display_name":"Multi-task learning","level":3,"score":0.29840001463890076},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.25369998812675476},{"id":"https://openalex.org/C77967617","wikidata":"https://www.wikidata.org/wiki/Q4677561","display_name":"Active learning (machine learning)","level":2,"score":0.25220000743865967}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s44443-025-00235-8","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s44443-025-00235-8","pdf_url":"https://link.springer.com/content/pdf/10.1007/s44443-025-00235-8.pdf","source":{"id":"https://openalex.org/S2764955546","display_name":"Journal of King Saud University - Computer and Information Sciences","issn_l":"1319-1578","issn":["1319-1578","2213-1248"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of King Saud University Computer and Information Sciences","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:e101924b818a4fcaa8613df26222cf44","is_oa":true,"landing_page_url":"https://doaj.org/article/e101924b818a4fcaa8613df26222cf44","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of King Saud University: Computer and Information Sciences, Vol 37, Iss 8, Pp 1-27 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1007/s44443-025-00235-8","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s44443-025-00235-8","pdf_url":"https://link.springer.com/content/pdf/10.1007/s44443-025-00235-8.pdf","source":{"id":"https://openalex.org/S2764955546","display_name":"Journal of King Saud University - Computer and Information Sciences","issn_l":"1319-1578","issn":["1319-1578","2213-1248"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of King Saud University Computer and Information Sciences","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G200133250","display_name":null,"funder_award_id":"3282025044","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G5370835836","display_name":null,"funder_award_id":"3282024050","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G7308139030","display_name":null,"funder_award_id":"3282024021","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"}],"funders":[{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7090347496.pdf","grobid_xml":"https://content.openalex.org/works/W7090347496.grobid-xml"},"referenced_works_count":24,"referenced_works":["https://openalex.org/W2250539671","https://openalex.org/W2493916176","https://openalex.org/W2560647685","https://openalex.org/W2805465321","https://openalex.org/W2949676527","https://openalex.org/W2969211527","https://openalex.org/W2995145810","https://openalex.org/W3018076949","https://openalex.org/W3098605233","https://openalex.org/W3137176977","https://openalex.org/W3173944302","https://openalex.org/W4285132119","https://openalex.org/W4292746273","https://openalex.org/W4306760315","https://openalex.org/W4312210066","https://openalex.org/W4384563052","https://openalex.org/W4385571101","https://openalex.org/W4389320863","https://openalex.org/W4392024469","https://openalex.org/W4394687915","https://openalex.org/W4394814093","https://openalex.org/W4398186386","https://openalex.org/W4401487240","https://openalex.org/W4406667603"],"related_works":[],"abstract_inverted_index":{"Webshell":[0],"is":[1,35,57,77,143],"a":[2,10,19,71,146,164],"backdoor":[3],"for":[4,129,192],"web":[5],"applications":[6],"and":[7,27,40,55,102,140,189],"has":[8],"become":[9],"major":[11],"threat":[12],"to":[13,59,160],"cyber":[14],"security.":[15],"This":[16,171,184],"paper":[17,123],"proposes":[18,124],"webshell":[20,120,130,196],"detection":[21,97],"method":[22,98,128],"based":[23],"on":[24,106],"PHP":[25,32],"opcodes":[26],"deep":[28],"learning.":[29],"First,":[30],"the":[31,61,66,96,107,116,151,157],"source":[33],"code":[34],"converted":[36],"into":[37,83],"an":[38,125,187],"opcode":[39],"then":[41],"extracted":[42,52],"by":[43],"Opcode":[44],"Double-Tuples":[45],"(ODTs).":[46],"Then,":[47],"semantic":[48],"vector":[49],"representations":[50],"are":[51,81],"using":[53],"CodeBert,":[54],"FastText":[56],"used":[58],"improve":[60],"feature":[62],"representation.":[63],"To":[64,113],"address":[65,115],"challenge":[67,117],"of":[68,118,156,169],"long":[69,91],"sequences,":[70],"sliding":[72],"window":[73],"attention":[74],"(SWA)":[75],"mechanism":[76],"designed.":[78,144],"Long":[79],"sequences":[80],"divided":[82],"overlapping":[84],"sub-windows,":[85],"effectively":[86],"capturing":[87],"malicious":[88],"behavior":[89],"in":[90],"files.":[92],"Experiments":[93],"show":[94],"that":[95],"achieves":[99],"99.2%":[100],"accuracy":[101],"99.1%":[103],"F1":[104,167],"score":[105,168],"test":[108],"set,":[109],"outperforming":[110],"existing":[111],"methods.":[112],"further":[114],"evolving":[119],"variants,":[121],"this":[122],"incremental":[126,149,175],"learning":[127,176],"detection.":[131],"A":[132],"joint":[133,152],"strategy":[134,153,172],"combining":[135],"Learning":[136],"Without":[137],"Forgetting":[138],"(LwF)":[139],"sample":[141],"replay":[142],"In":[145],"simulated":[147],"two-stage":[148],"experiment,":[150],"saves":[154],"59.2%":[155],"time":[158],"compared":[159],"full":[161],"training,":[162],"with":[163],"final":[165],"task":[166],"98.43%.":[170],"surpasses":[173],"traditional":[174],"methods":[177],"such":[178],"as":[179],"Elastic":[180],"Weight":[181],"Consolidation":[182],"(EWC).":[183],"study":[185],"provides":[186],"efficient":[188],"sustainable":[190],"solution":[191],"real-time":[193],"defense":[194],"against":[195],"variants.":[197]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-06-13T06:13:01.061226","created_date":"2025-10-14T00:00:00"}