{"id":"https://openalex.org/W4206584951","doi":"https://doi.org/10.1109/ai-csp52968.2021.9671226","title":"RF-DNN2: An ensemble learner for effective detection of PHP Webshells","display_name":"RF-DNN2: An ensemble learner for effective detection of PHP Webshells","publication_year":2021,"publication_date":"2021-11-20","ids":{"openalex":"https://openalex.org/W4206584951","doi":"https://doi.org/10.1109/ai-csp52968.2021.9671226"},"language":"en","primary_location":{"id":"doi:10.1109/ai-csp52968.2021.9671226","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ai-csp52968.2021.9671226","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 International Conference on Artificial Intelligence for Cyber Security Systems and Privacy (AI-CSP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042601599","display_name":"Abdelhakim Hannousse","orcid":"https://orcid.org/0000-0002-8895-4161"},"institutions":[{"id":"https://openalex.org/I4210097536","display_name":"University of Guelma","ror":"https://ror.org/00xe6p546","country_code":"DZ","type":"education","lineage":["https://openalex.org/I4210097536"]}],"countries":["DZ"],"is_corresponding":false,"raw_author_name":"Abdelhakim Hannousse","raw_affiliation_strings":["University of 8 May 1945 Guelma, Guelma, Algeria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of 8 May 1945 Guelma, Guelma, Algeria","institution_ids":["https://openalex.org/I4210097536"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5065297509","display_name":"Salima Yahiouche","orcid":"https://orcid.org/0000-0002-8524-5570"},"institutions":[{"id":"https://openalex.org/I108754898","display_name":"Badji Mokhtar-Annaba University","ror":"https://ror.org/03sf55932","country_code":"DZ","type":"education","lineage":["https://openalex.org/I108754898"]}],"countries":["DZ"],"is_corresponding":false,"raw_author_name":"Salima Yahiouche","raw_affiliation_strings":["LRS Laboratory, Badji Mokhtar University, Annaba, Algeria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"LRS Laboratory, Badji Mokhtar University, Annaba, Algeria","institution_ids":["https://openalex.org/I108754898"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.5076,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.65322458,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":94},"biblio":{"volume":"15","issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7368685007095337},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6415627002716064},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.5908557176589966},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.5824337601661682},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.5732892751693726},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.5064641237258911},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5015120506286621},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4775070548057556},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.3716776669025421},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.24124225974082947},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.23880180716514587}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7368685007095337},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6415627002716064},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.5908557176589966},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5824337601661682},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.5732892751693726},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.5064641237258911},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5015120506286621},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4775070548057556},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3716776669025421},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.24124225974082947},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.23880180716514587}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ai-csp52968.2021.9671226","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ai-csp52968.2021.9671226","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 International Conference on Artificial Intelligence for Cyber Security Systems and Privacy (AI-CSP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5799999833106995,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W1580049798","https://openalex.org/W2095705004","https://openalex.org/W2336291507","https://openalex.org/W2765113514","https://openalex.org/W2807614421","https://openalex.org/W2904096920","https://openalex.org/W2905208070","https://openalex.org/W2990782876","https://openalex.org/W2996036101","https://openalex.org/W3000534264","https://openalex.org/W3080126850","https://openalex.org/W3083004155","https://openalex.org/W3084240427","https://openalex.org/W3089441536","https://openalex.org/W3095064644","https://openalex.org/W3168918750","https://openalex.org/W6634569365","https://openalex.org/W6674330103"],"related_works":["https://openalex.org/W2626999804","https://openalex.org/W4250004941","https://openalex.org/W2736202444","https://openalex.org/W2049015391","https://openalex.org/W2137014442","https://openalex.org/W1533158771","https://openalex.org/W122082928","https://openalex.org/W2104288289","https://openalex.org/W2521397622","https://openalex.org/W4294067941"],"abstract_inverted_index":{"The":[0,110,131,180],"explosion":[1],"of":[2,12,103,116,143,173],"web":[3,28,41],"services":[4],"has":[5,186],"been":[6],"accompanied":[7],"by":[8,85],"a":[9,127,171],"rapid":[10],"development":[11],"dangerous":[13,77],"cyberattack":[14,25],"methods.":[15],"Webshells":[16,35],"are":[17,36],"considered":[18],"among":[19],"the":[20,31,72,101,114,146,184,187],"easiest":[21],"and":[22,47,52,66,87,122,145,167,176,191],"most":[23],"persistent":[24,46],"methods":[26],"targeting":[27],"servers":[29,42],"in":[30,106],"last":[32],"few":[33],"years.":[34],"malicious":[37],"scripts":[38],"injected":[39],"into":[40],"to":[43,71],"gain":[44],"illegal":[45],"remote":[48],"access":[49,60],"through":[50],"simple":[51],"benign":[53],"HTTP":[54],"requests.":[55],"Through":[56],"webshells,":[57],"hackers":[58],"can":[59,79],"confidential":[61],"data,":[62],"execute":[63],"system":[64],"commands":[65],"compromise":[67],"more":[68],"machines":[69],"connected":[70],"target":[73],"server.":[74],"All":[75],"those":[76],"actions":[78],"be":[80],"performed":[81],"without":[82],"being":[83],"noticed":[84],"administrators":[86],"malware":[88],"detectors.":[89],"In":[90],"this":[91],"paper,":[92],"we":[93],"propose":[94],"an":[95],"ensemble":[96,178],"learner":[97],"model":[98,112,136,151],"named":[99],"RF-DNN2for":[100],"detection":[102],"webshells":[104,144],"written":[105],"PHP":[107],"scripting":[108],"language.":[109],"proposed":[111],"combines":[113],"predictions":[115],"two":[117],"deep":[118,133,148,163],"neural":[119,134,149,164],"network":[120,135,150,165],"models":[121,166],"uses":[123],"Random":[124],"Forest":[125],"as":[126],"stacking":[128],"meta":[129],"classifier.":[130],"first":[132],"is":[137,152],"trained":[138,153],"on":[139,154],"vectorized":[140,155],"source":[141],"codes":[142],"second":[147],"opcode":[156],"sequences":[157],"generated":[158],"from":[159],"webshell":[160],"sources.":[161],"Individual":[162],"RF-DNN2are":[168],"compared":[169],"with":[170],"set":[172],"traditional":[174],"classifiers":[175],"other":[177],"learners.":[179],"experiments":[181],"show":[182],"that":[183],"RF-DNN2model":[185],"best":[188],"accuracy":[189],"98%":[190],"macro":[192],"F1-score":[193],"97.45%.":[194]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}