MMFDetect: Webshell Evasion Detect Method Based on Multimodal Feature Fusion

In the context of escalating network adversarial challenges, effectively identifying a Webshell processed using evasion techniques such as encoding, obfuscation, and nesting remains a critical challenge in the field of cybersecurity. To address the poor detection performance of the existing Webshell detection methods for evasion samples, this study proposes a multimodal feature fusion-based evasion Webshell detection method (MMF-Detect). This method extracts RGB image features and textual vector features from two modalities: the visual and semantic modalities of Webshell file content. A multimodal feature fusion classification model was designed to classify features from both modalities to achieve Webshell detection. The multimodal feature fusion classification model consists of a text classifier based on a large language model (CodeBERT), an image classifier based on a convolutional neural network (CNN), and a decision-level feature fusion mechanism. The experimental results show that the MMF-Detect method not only demonstrated excellent performance in detecting a conventional Webshell but also achieved an accuracy of 99.47% in detecting an evasive Webshell, representing a significant improvement compared to traditional models.