{"id":"https://openalex.org/W3000534264","doi":"https://doi.org/10.3390/fi12010012","title":"Mitigating Webshell Attacks through Machine Learning Techniques","display_name":"Mitigating Webshell Attacks through Machine Learning Techniques","publication_year":2020,"publication_date":"2020-01-14","ids":{"openalex":"https://openalex.org/W3000534264","doi":"https://doi.org/10.3390/fi12010012","mag":"3000534264"},"language":"en","primary_location":{"id":"doi:10.3390/fi12010012","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi12010012","pdf_url":"https://www.mdpi.com/1999-5903/12/1/12/pdf","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1999-5903/12/1/12/pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100363325","display_name":"Youguang Guo","orcid":"https://orcid.org/0000-0001-6182-0684"},"institutions":[{"id":"https://openalex.org/I4210110558","display_name":"Xi'an Technological University","ror":"https://ror.org/01t8prc81","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210110558"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"You Guo","raw_affiliation_strings":["School of Computing Science and Engineering, Xi\u2019an Technological University, Xi\u2019an 710021, China","School of Computing Science and Engineering, Xi'an Technological University, Xi'an 710021, China"],"affiliations":[{"raw_affiliation_string":"School of Computing Science and Engineering, Xi\u2019an Technological University, Xi\u2019an 710021, China","institution_ids":["https://openalex.org/I4210110558"]},{"raw_affiliation_string":"School of Computing Science and Engineering, Xi'an Technological University, Xi'an 710021, China","institution_ids":["https://openalex.org/I4210110558"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068515994","display_name":"H\u00e9ctor Marco-Gisbert","orcid":"https://orcid.org/0000-0001-6976-5763"},"institutions":[{"id":"https://openalex.org/I868834043","display_name":"University of the West of Scotland","ror":"https://ror.org/04w3d2v20","country_code":"GB","type":"education","lineage":["https://openalex.org/I868834043"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Hector Marco-Gisbert","raw_affiliation_strings":["School of Computing, Engineering and Physical Sciences, University of the West of Scotland, High Street, Paisley PA1 2BE, UK"],"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and Physical Sciences, University of the West of Scotland, High Street, Paisley PA1 2BE, UK","institution_ids":["https://openalex.org/I868834043"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011156799","display_name":"Paul Keir","orcid":"https://orcid.org/0000-0002-4781-9377"},"institutions":[{"id":"https://openalex.org/I868834043","display_name":"University of the West of Scotland","ror":"https://ror.org/04w3d2v20","country_code":"GB","type":"education","lineage":["https://openalex.org/I868834043"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Paul Keir","raw_affiliation_strings":["School of Computing, Engineering and Physical Sciences, University of the West of Scotland, High Street, Paisley PA1 2BE, UK"],"affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and Physical Sciences, University of the West of Scotland, High Street, Paisley PA1 2BE, UK","institution_ids":["https://openalex.org/I868834043"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5068515994"],"corresponding_institution_ids":["https://openalex.org/I868834043"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1515},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1515},"fwci":3.4992,"has_fulltext":true,"cited_by_count":32,"citation_normalized_percentile":{"value":0.93398071,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"12","issue":"1","first_page":"12","last_page":"12"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/opcode","display_name":"Opcode","score":0.9722447395324707},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.9186868667602539},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5973392724990845},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5773787498474121},{"id":"https://openalex.org/keywords/naive-bayes-classifier","display_name":"Naive Bayes classifier","score":0.5738899111747742},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5265855193138123},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.4911641776561737},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.46550753712654114},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.4317643642425537},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.43157973885536194},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.37486356496810913},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.23650074005126953},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.16640141606330872},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.10528150200843811}],"concepts":[{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.9722447395324707},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.9186868667602539},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5973392724990845},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5773787498474121},{"id":"https://openalex.org/C52001869","wikidata":"https://www.wikidata.org/wiki/Q812530","display_name":"Naive Bayes classifier","level":3,"score":0.5738899111747742},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5265855193138123},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.4911641776561737},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.46550753712654114},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.4317643642425537},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.43157973885536194},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37486356496810913},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.23650074005126953},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.16640141606330872},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.10528150200843811},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.0}],"mesh":[],"locations_count":7,"locations":[{"id":"doi:10.3390/fi12010012","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi12010012","pdf_url":"https://www.mdpi.com/1999-5903/12/1/12/pdf","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:pure.atira.dk:openaire/186fce1f-d319-46ce-96b2-4aa156c26406","is_oa":true,"landing_page_url":"https://research-portal.uws.ac.uk/en/publications/186fce1f-d319-46ce-96b2-4aa156c26406","pdf_url":null,"source":{"id":"https://openalex.org/S4306402572","display_name":"The UWS Academic Portal (University of the West of Scotland)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I868834043","host_organization_name":"University of the West of Scotland","host_organization_lineage":["https://openalex.org/I868834043"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Guo, Y, Marco-Gisbert, H & Keir, P 2020, 'Mitigating webshell attacks through machine learning techniques', Future Internet, vol. 12, no. 1, 12. https://doi.org/10.3390/fi12010012","raw_type":"info:eu-repo/semantics/publishedVersion"},{"id":"pmh:oai:RePEc:gam:jftint:v:12:y:2020:i:1:p:12-:d:308719","is_oa":false,"landing_page_url":"https://www.mdpi.com/1999-5903/12/1/12/","pdf_url":null,"source":{"id":"https://openalex.org/S4306401271","display_name":"RePEc: Research Papers in Economics","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I77793887","host_organization_name":"Federal Reserve Bank of St. Louis","host_organization_lineage":["https://openalex.org/I77793887"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},{"id":"pmh:oai:doaj.org/article:9ba6b09236db4e5e89515b0d1f0861b7","is_oa":true,"landing_page_url":"https://doaj.org/article/9ba6b09236db4e5e89515b0d1f0861b7","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 12, Iss 1, p 12 (2020)","raw_type":"article"},{"id":"pmh:oai:mdpi.com:/1999-5903/12/1/12/","is_oa":true,"landing_page_url":"http://dx.doi.org/10.3390/fi12010012","pdf_url":null,"source":{"id":"https://openalex.org/S4306400947","display_name":"MDPI (MDPI AG)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210097602","host_organization_name":"Multidisciplinary Digital Publishing Institute (Switzerland)","host_organization_lineage":["https://openalex.org/I4210097602"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet","raw_type":"Text"},{"id":"pmh:oai:pure.atira.dk:publications/186fce1f-d319-46ce-96b2-4aa156c26406","is_oa":true,"landing_page_url":"https://www.mdpi.com/1999-5903/12/1/12","pdf_url":null,"source":{"id":"https://openalex.org/S4306402572","display_name":"The UWS Academic Portal (University of the West of Scotland)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I868834043","host_organization_name":"University of the West of Scotland","host_organization_lineage":["https://openalex.org/I868834043"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Guo, Y, Marco-Gisbert, H & Keir, P 2020, 'Mitigating webshell attacks through machine learning techniques', Future Internet, vol. 12, no. 1, 12. https://doi.org/10.3390/fi12010012","raw_type":"info:eu-repo/semantics/publishedVersion"},{"id":"pmh:oai:riunet.upv.es:10251/176997","is_oa":true,"landing_page_url":"http://hdl.handle.net/10251/176997","pdf_url":null,"source":{"id":"https://openalex.org/S4306401500","display_name":"RiuNet (Politechnical University of Valencia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I60053951","host_organization_name":"Universitat Polit\u00e8cnica de Val\u00e8ncia","host_organization_lineage":["https://openalex.org/I60053951"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.3390/fi12010012","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi12010012","pdf_url":"https://www.mdpi.com/1999-5903/12/1/12/pdf","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3000534264.pdf","grobid_xml":"https://content.openalex.org/works/W3000534264.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W36091977","https://openalex.org/W2006374488","https://openalex.org/W2092873805","https://openalex.org/W2125055259","https://openalex.org/W2129656140","https://openalex.org/W2294744997","https://openalex.org/W2336291507","https://openalex.org/W2351238446","https://openalex.org/W2389369929","https://openalex.org/W2560582047","https://openalex.org/W2605575598","https://openalex.org/W2796849954","https://openalex.org/W2807614421","https://openalex.org/W2884764722","https://openalex.org/W2917451471","https://openalex.org/W2946573576","https://openalex.org/W2973251808","https://openalex.org/W3089383752","https://openalex.org/W6696861789","https://openalex.org/W6762753957","https://openalex.org/W6783476056"],"related_works":["https://openalex.org/W2004101185","https://openalex.org/W2046404690","https://openalex.org/W4200046519","https://openalex.org/W2347098755","https://openalex.org/W2794638429","https://openalex.org/W2600055486","https://openalex.org/W2775473347","https://openalex.org/W4287115104","https://openalex.org/W4390224659","https://openalex.org/W3173300022"],"abstract_inverted_index":{"A":[0],"webshell":[1,89,140,151],"is":[2,14,30,101],"a":[3,20,58,86,102,116,132],"command":[4],"execution":[5],"environment":[6],"in":[7],"the":[8,67,92,121,126,138,146],"form":[9],"of":[10,31,69,104,119,134,150],"web":[11,24,35],"pages.":[12],"It":[13],"often":[15],"used":[16],"by":[17],"attackers":[18],"as":[19],"backdoor":[21],"tool":[22],"for":[23,62],"server":[25,36],"operations.":[26],"Accurately":[27],"detecting":[28],"webshells":[29,42,73],"great":[32],"significance":[33],"to":[34],"protection.":[37],"Most":[38],"security":[39],"products":[40],"detect":[41,131],"based":[43],"on":[44,115],"feature-matching":[45,55],"methods\u2014matching":[46],"input":[47],"scripts":[48],"against":[49],"pre-built":[50],"malicious":[51],"code":[52],"collections.":[53],"The":[54],"method":[56,128,144],"has":[57],"low":[59],"detection":[60,90,141],"rate":[61],"obfuscated":[63],"webshells.":[64,135],"However,":[65],"with":[66,137],"help":[68],"machine":[70],"learning":[71],"algorithms,":[72],"can":[74],"be":[75],"detected":[76],"more":[77],"efficiently":[78],"and":[79,96,108,113,148],"accurately.":[80],"In":[81],"this":[82,143],"paper,":[83],"we":[84],"propose":[85],"new":[87],"PHP":[88],"model,":[91,99],"NB-Opcode":[93],"(na\u00efve":[94],"Bayes":[95,106],"opcode":[97,109],"sequence)":[98],"which":[100],"combination":[103],"na\u00efve":[105],"classifiers":[107],"sequences.":[110],"Through":[111],"experiments":[112],"analysis":[114],"large":[117],"number":[118],"samples,":[120],"experimental":[122],"results":[123],"show":[124],"that":[125],"proposed":[127],"could":[129],"effectively":[130],"range":[133],"Compared":[136],"traditional":[139],"methods,":[142],"improves":[145],"efficiency":[147],"accuracy":[149],"detection.":[152]},"counts_by_year":[{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":3}],"updated_date":"2026-04-05T17:49:38.594831","created_date":"2025-10-10T00:00:00"}