Abstract: WebShell attack, a type of network attack, can control the website completely for a long time after a successful attack, which is extremely harmful. Most of the previous studies have concentrated on detecting and alerting WebShell attack traffic without distinguishing whether the attack is ultimately successful. As a result, in actual network security protection and monitoring work, security personnel are overwhelmed by a large number of WebShell attack alerts and are prone to alert fatigue, making it difficult to filter out successful WebShell attacks which are truly threatening. To address the problem, this paper proposes an anomaly detection method based on Web page structural similarity to quickly determine whether WebShell attacks are successful. Based on the structural information of the response pages of failed WebShell attack traffic, this method uses the HuntSzymanski algorithm to calculate structural similarity and then generate Web page templates. During the detection phase, this method uses the generated Web page templates for pattern matching and similarity assessment to determine whether the WebShell attacks are successful. It can well distinguish between successful and failed WebShell attack traffic, achieving an accuracy rate of 99.02% and a recall rate of 99.37%. This method has been applied to Wukong network security defense system and realizes rapid identification of successful WebShell attacks.

Key words: WebShell, anomaly traffic detection, alert fatigue, structural similarity, Web page template

摘要： WebShell攻击作为网络攻击的一种，攻击成功后可对网站进行长期完全控制，具有极大的危害性.目前检测WebShell攻击流量的研究只对WebShell攻击行为进行告警，不考虑WebShell攻击是否成功，导致在实际的网络安全保障及监测工作中，安全运营人员疲于应对海量WebShell攻击告警，容易产生告警疲劳，难以筛选出告警中真正有威胁的WebShell攻击成功流量.针对该问题，提出了一种基于网页结构相似性的异常检测方法，实现WebShell攻击成功的快速判别.该方法基于WebShell攻击失败流量响应页面的结构信息，使用HuntSzymanski算法计算结构相似度生成网页模板；检测阶段将待测试流量与生成的网页模板进行模式匹配和相似度评估，以判断WebShell攻击流量是否攻击成功.该方法能够很好地区分WebShell攻击成功与失败流量，达到了99.02%的准确率和99.37%的召回率.目前该方法已经应用于悟空网络安全防御系统，实现对WebShell攻击成功的快速判断.

关键词: WebShell, 异常流量检测, 告警疲劳, 结构相似性, 网页模板