{"id":"https://openalex.org/W4206584951","doi":"https://doi.org/10.1109/ai-csp52968.2021.9671226","title":"RF-DNN<sup>2</sup>: An ensemble learner for effective detection of PHP Webshells","display_name":"RF-DNN<sup>2</sup>: An ensemble learner for effective detection of PHP Webshells","publication_year":2021,"publication_date":"2021-11-20","ids":{"openalex":"https://openalex.org/W4206584951","doi":"https://doi.org/10.1109/ai-csp52968.2021.9671226"},"language":"en","primary_location":{"id":"doi:10.1109/ai-csp52968.2021.9671226","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ai-csp52968.2021.9671226","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 International Conference on Artificial Intelligence for Cyber Security Systems and Privacy (AI-CSP)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042601599","display_name":"Abdelhakim Hannousse","orcid":"https://orcid.org/0000-0002-8895-4161"},"institutions":[{"id":"https://openalex.org/I4210097536","display_name":"University of Guelma","ror":"https://ror.org/00xe6p546","country_code":"DZ","type":"education","lineage":["https://openalex.org/I4210097536"]}],"countries":["DZ"],"is_corresponding":true,"raw_author_name":"Abdelhakim Hannousse","raw_affiliation_strings":["University of 8 May 1945 Guelma, Guelma, Algeria"],"affiliations":[{"raw_affiliation_string":"University of 8 May 1945 Guelma, Guelma, Algeria","institution_ids":["https://openalex.org/I4210097536"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5065297509","display_name":"Salima Yahiouche","orcid":"https://orcid.org/0000-0002-8524-5570"},"institutions":[{"id":"https://openalex.org/I108754898","display_name":"Badji Mokhtar University","ror":"https://ror.org/03sf55932","country_code":"DZ","type":"education","lineage":["https://openalex.org/I108754898"]}],"countries":["DZ"],"is_corresponding":false,"raw_author_name":"Salima Yahiouche","raw_affiliation_strings":["LRS Laboratory, Badji Mokhtar University, Annaba, Algeria"],"affiliations":[{"raw_affiliation_string":"LRS Laboratory, Badji Mokhtar University, Annaba, Algeria","institution_ids":["https://openalex.org/I108754898"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5042601599"],"corresponding_institution_ids":["https://openalex.org/I4210097536"],"apc_list":null,"apc_paid":null,"fwci":0.5508,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.75325345,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":94},"biblio":{"volume":"15","issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7368685007095337},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6415627002716064},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.5908557176589966},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.5824337601661682},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.5732892751693726},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.5064641237258911},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5015120506286621},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4775070548057556},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.3716776669025421},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.24124225974082947},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.23880180716514587}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7368685007095337},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6415627002716064},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.5908557176589966},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5824337601661682},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.5732892751693726},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.5064641237258911},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5015120506286621},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4775070548057556},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3716776669025421},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.24124225974082947},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.23880180716514587}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ai-csp52968.2021.9671226","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ai-csp52968.2021.9671226","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2021 International Conference on Artificial Intelligence for Cyber Security Systems and Privacy (AI-CSP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5799999833106995,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W1580049798","https://openalex.org/W2095705004","https://openalex.org/W2336291507","https://openalex.org/W2765113514","https://openalex.org/W2807614421","https://openalex.org/W2904096920","https://openalex.org/W2905208070","https://openalex.org/W2990782876","https://openalex.org/W2996036101","https://openalex.org/W3000534264","https://openalex.org/W3080126850","https://openalex.org/W3083004155","https://openalex.org/W3084240427","https://openalex.org/W3089441536","https://openalex.org/W3095064644","https://openalex.org/W3168918750","https://openalex.org/W6634569365","https://openalex.org/W6674330103"],"related_works":["https://openalex.org/W2626999804","https://openalex.org/W4250004941","https://openalex.org/W2736202444","https://openalex.org/W2049015391","https://openalex.org/W2137014442","https://openalex.org/W1533158771","https://openalex.org/W122082928","https://openalex.org/W2104288289","https://openalex.org/W2521397622","https://openalex.org/W4294067941"],"abstract_inverted_index":{"The":[0,114,135,188],"explosion":[1],"of":[2,12,107,120,147,181],"web":[3,28,41],"services":[4],"has":[5,198],"been":[6],"accompanied":[7],"by":[8,85],"a":[9,131,179],"rapid":[10],"development":[11],"dangerous":[13,77],"cyberattack":[14,25],"methods.":[15],"Webshells":[16,35],"are":[17,36,176],"considered":[18],"among":[19],"the":[20,31,72,105,118,150,192,199],"easiest":[21],"and":[22,47,52,66,87,126,149,171,184,203],"most":[23],"persistent":[24,46],"methods":[26],"targeting":[27],"servers":[29,42],"in":[30,110],"last":[32],"few":[33],"years.":[34],"malicious":[37],"scripts":[38],"injected":[39],"into":[40],"to":[43,71],"gain":[44],"illegal":[45],"remote":[48],"access":[49,60],"through":[50],"simple":[51],"benign":[53],"HTTP":[54],"requests.":[55],"Through":[56],"webshells,":[57],"hackers":[58],"can":[59,79],"confidential":[61],"data,":[62],"execute":[63],"system":[64],"commands":[65],"compromise":[67],"more":[68],"machines":[69],"connected":[70],"target":[73],"server.":[74],"All":[75],"those":[76],"actions":[78],"be":[80],"performed":[81],"without":[82],"being":[83],"noticed":[84],"administrators":[86],"malware":[88],"detectors.":[89],"In":[90],"this":[91],"paper,":[92],"we":[93],"propose":[94],"an":[95],"ensemble":[96,186],"learner":[97],"model":[98,116,140,155,197],"named":[99],"RF-DNN":[100,172,193],"<sup":[101,173,194],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[102,174,195],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">2</sup>":[103,175,196],"for":[104],"detection":[106],"webshells":[108,148],"written":[109],"PHP":[111],"scripting":[112],"language.":[113],"proposed":[115],"combines":[117],"predictions":[119],"two":[121],"deep":[122,137,152,167],"neural":[123,138,153,168],"network":[124,139,154,169],"models":[125,170],"uses":[127],"Random":[128],"Forest":[129],"as":[130],"stacking":[132],"meta":[133],"classifier.":[134],"first":[136],"is":[141,156],"trained":[142,157],"on":[143,158],"vectorized":[144,159],"source":[145],"codes":[146],"second":[151],"opcode":[160],"sequences":[161],"generated":[162],"from":[163],"webshell":[164],"sources.":[165],"Individual":[166],"compared":[177],"with":[178],"set":[180],"traditional":[182],"classifiers":[183],"other":[185],"learners.":[187],"experiments":[189],"show":[190],"that":[191],"best":[200],"accuracy":[201],"98%":[202],"macro":[204],"F1-score":[205],"97.45%.":[206]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}