Abstract:

In order to solve the problems of “dimensional disaster” and  poor detection of WebShell samples in text vectorization processing, the paper proposes a WebShell feature processing algorithm based on Nearest Neighborhood Component Analysis（NCA）. This method automatically learns the projection matrix through NCA, and completes the reduction of the high-dimensional feature space while retaining the global information. In order to avoid relying too much on the overall training sample, the ReliefF feature selection method is used to further optimize feature processing from the perspective of local information and improve WebShell model checking performance. Experiments show that the WebShell feature processing method based on nearest neighborhood component analysis can effectively detect WebShell, and is superior to the WebShell detection model of most traditional feature processing algorithms in accuracy and recall rate.

Key words: WebShell, feature processing, neighborhood component analysis, ReliefF algorithm

摘要：

为解决WebShell样本在文本向量化处理中出现的“维度灾难”和检测效果差的问题，提出了基于近邻成分分析（Neighborhood Component Analysis，NCA）的WebShell特征处理算法。算法通过NCA自动化学习投影矩阵，在保留全局信息的同时完成高维特征空间的约减，为避免过于依赖总体训练样本，采用ReliefF特征选择方法从局部信息的角度进一步优化特征处理，提高WebShell模型检测性能。实验表明，基于近邻成分分析的WebShell特征处理方法能有效检测WebShell，并在准确率、召回率上优于大多数传统特征处理算法的WebShell检测模型。

关键词: WebShell, 特征处理, 近邻成分分析, ReliefF算法