Abstract:Webshell is a highly concealed tool for Web attack, which is used to obtain the operating authority of servers. When writing Webshell, the attacker uses a series of anti-virus techniques to bypass the firewall, which leads to ineffective Webshell detection by existing methods. In response to this situation, we propose a Bi-GRU-based Webshell detection method from the perspective of text classification. Firstly, this method compiles webpage script files to obtain the opcode instructions. Secondly, the instructions are converted to feature vectors by the Word2Vec algorithm. Finally, a variety of deep learning models are used for training with accuracy, false positive rate, and false negative rate as evaluation criteria. The experimental results confirm the feasibility of the Bi-GRU-based Webshell detection since it is better than other algorithm models.