Identifying web shell applications through file analysis

1. A method for identifying malicious applications, the method comprising:

accessing, through an interface to a computer-readable medium, at least one file;

performing, using a configured processor, a lexical analysis on content of the at least one file to turn the content into lexed components that include syntactically meaningful tokens;

extracting, using the configured processor, at least one feature related to the file based on at least one of the lexed components and unlexed components of the file;

providing, using the configured processor, the at least one feature to a classifier as input;

executing, using the classifier, at least one machine learning procedure to analyze the at least one feature to calculate a probabilistic assessment indicating the likelihood that the file is a web shell application; and

removing the file from an affected system upon the probabilistic assessment indicating that the file is likely a web shell application.

2. The method of claim 1 , further comprising:

extracting at least one static feature related to a first known web shell application;

extracting at least one dynamic feature related to a second known web shell application; and

training the classifier using the at least one extracted static feature and the at least one extracted dynamic feature.

3. The method of claim 1 , wherein the at least one feature includes at least one of an index of coincidence, entropy rate, system function calls, behavior of the file when executed in a controlled environment, a graph of function calls within the file, and level of nesting of function calls.

4. The method of claim 1 , wherein the classifier is configured to execute a gradient boosting technique to compare the file with a set of known web shell applications to classify the file as a web shell application or a non-web shell application.

5. A system for identifying malicious applications, the system comprising:

an interface to a computer-readable medium configured to access at least one file;

a memory; and

a processor, the memory storing instructions configuring the processor to:

perform a lexical analysis on content of the at least one file to turn the content into lexed components that include syntactically meaningful tokens;

extract at least one feature related to the file based on at least one of the lexed components and unlexed components of the file;

provide the at least one feature to a classifier as input, wherein the classifier is configured to execute at least one machine learning procedure to analyze the at least one feature to calculate a probabilistic assessment indicating the likelihood the file is a web shell application;

execute the classifier receiving the at least one feature to calculate a probabilistic assessment indicating the likelihood that the file is a web shell application; and

remove the file from an affected system upon the probabilistic assessment indicating the file is likely a web shell application.

6. The system of claim 5 , wherein the processor is further configured to:

extract at least one static feature related to a first known web shell application;

extract at least one dynamic feature related to a second known web shell application; and

train the classifier using the at least one extracted static feature and the at least one extracted dynamic feature.

7. The system of claim 5 , wherein the at least one feature includes at least one of index of coincidence, entropy rate, system function calls, behavior of the file when executed in a controlled environment, a graph of function calls within the file, and level of nesting of function calls.

8. The system of claim 5 , wherein the classifier is configured to execute a gradient boosting technique to compare the file with a set of known web shells to classify the file as a web shell application or a non-web shell application.

9. A non-transitory computer readable medium containing computer-executable instructions for performing a method for identifying malicious applications, the medium comprising:

computer-executable instructions for accessing, through an interface to a computer-readable medium, at least one file;

computer-executable instructions for performing, using a configured processor a lexical analysis on content of the at least one file to turn the content into lexed components that include syntactically meaningful tokens;

computer-executable instructions for extracting, using the configured processor, at least one feature related to file based on at least one of the lexed components and unlexed components of the file;

computer-executable instructions for providing, using the configured processor, the at least one feature to a classifier as input;

computer-executable instructions for executing, using the classifier, at least one machine learning procedure to analyze the at least one feature to calculate a probabilistic assessment indicating the likelihood that the file is a web shell application; and

computer-executable instructions for removing the file from an affected system upon the probabilistic assessment indicating that the file is likely a web shell application.

10. The computer readable medium of claim 9 , further comprising:

computer-executable instructions for extracting at least one static feature related to a first known web shell application;

computer-executable instructions for extracting at least one dynamic feature related to a second known web shell application; and

computer-executable instructions for training the classifier using the at least one extracted static feature and the at least one extracted dynamic feature.

11. The computer readable medium of claim 9 , wherein the at least one feature includes at least one of an index of coincidence, entropy rate, system function calls, behavior of the file when executed in a controlled environment, a graph of function calls within the file, and level of nesting of function calls.

12. The computer readable medium of claim 9 , wherein the classifier is configured to execute a gradient boosting technique to compare the file with a set of known web shell applications to classify the file as a web shell application or a non-web shell application.