🤖 AI Summary
This work addresses the challenge that existing webshell detection methods struggle to keep pace with rapidly evolving obfuscated variants and suffer from high false-positive rates on benign obfuscated scripts. To overcome these limitations, the authors propose an adversarial co-evolution framework in which a generator and a multi-perspective detector iteratively train each other to continuously enhance defensive capabilities. The approach innovatively leverages de-maliciousized samples as high-quality hard negatives and integrates supervised fine-tuning with preference-based reinforcement learning to generate highly evasive webshells. The detector combines multi-view features, including semantic compression of long strings, pruned abstract syntax tree (AST) structures, and Shannon entropy. Evaluated on the FWOID benchmark, the method achieves an F1-score of 0.981, and its generated samples attain a 0.939 evasion success rate against commercial VirusTotal engines, significantly reducing false positives while improving generalization.
📝 Abstract
Webshells remain a primary foothold for attackers to compromise servers, particularly within PHP ecosystems. However, existing detection mechanisms often struggle to keep pace with rapid variant evolution and sophisticated obfuscation techniques that camouflage malicious intent. Furthermore, many current defenses suffer from high false-alarm rates when encountering benign administrative scripts that employ heavy obfuscation for intellectual property protection. To address these challenges, we present ShellForge, an adversarial co-evolution framework that couples automated webshell generation with multi-view detection to continuously harden defensive boundaries. The framework operates through an iterative co-training loop where a generator and a detector mutually reinforce each other via the exchange of hard samples. The generator is optimized through supervised fine-tuning and preference-based reinforcement learning to synthesize functional, highly evasive variants. Simultaneously, we develop a multi-view fusion detector that integrates semantic features from long-string compression, structural features from pruned abstract syntax trees, and global statistical indicators such as Shannon entropy. To minimize false positives, ShellForge utilizes a LLM-based transformation to create de-malicious samples--scripts that retain complex obfuscation patterns but lack harmful payloads--serving as high-quality hard negatives during training. Evaluations on the public FWOID benchmark demonstrate that ShellForge significantly enhances defensive robustness. Upon convergence, the detector maintains a 0.981 F1-score while the generator achieves a 0.939 evasion rate against commercial engines on VirusTotal.