基于网页结构相似性的WebShell攻击成功快速判别方法OA

WebShell attack,a type of network attack,can control the website completely for a long time after a successful attack,which is extremely harmful.Most of the previous studies have concentrated on detecting and alerting WebShell attack traffic without distinguishing whether the attack is ultimately successful.As a result,in actual network security protection and monitoring work,security personnel are overwhelmed by a large number of WebShell attack alerts and are prone to alert fatigue,making it difficult to filter out successful WebShell attacks which are truly threatening.To address the problem,this paper proposes an anomaly detection method based on Web page structural similarity to quickly determine whether WebShell attacks are successful.Based on the structural information of the response pages of failed WebShell attack traffic,this method uses the Hunt-Szymanski algorithm to calculate structural similarity and then generate Web page templates.During the detection phase,this method uses the generated Web page templates for pattern matching and similarity assessment to determine whether the WebShell attacks are successful.It can well distinguish between successful and failed WebShell attack traffic,achieving an accuracy rate of 99.02％and a recall rate of 99.37％.This method has been applied to Wukong network security defense system and realizes rapid identification of successful WebShell attacks.