Web shell classifier training

1. A method for training a web shell application classifier, the method comprising:

accessing a known web shell application;

extracting a first plurality of descriptive features describing the known web shell application, wherein the first plurality of descriptive features comprises a static feature relating to a lexical component from content of the web shell application;

extracting a second plurality of descriptive features describing the known web shell application, wherein the second plurality of descriptive features comprises a dynamic feature relating to monitored behavior of the known web shell application when executed; and

generating, based on the first plurality of descriptive features and the second plurality of descriptive features, a machine learning model that determines whether an unknown application file is a web shell application, wherein the generated model outputs, for each respective feature of a third plurality of descriptive features of the unknown application file, a respective vote of whether the respective feature indicates the unknown application file is a web shell application, and wherein the respective votes are aggregated to provide an overall result of whether the unknown application file is a web shell application.

2. The method of claim 1 , further comprising:

accessing at least one known non-web shell application;

extracting at least one descriptive feature describing each of the at least one known non-web shell application; and

generating the machine learning model based also on the at least one descriptive feature of the at least one known non-web shell application.

3. The method of claim 1 , wherein at least one of the first plurality of descriptive features includes a token variable, an assignment operator, or a statement-ending character.

4. The method of claim 1 , wherein at least one of the first plurality of descriptive features includes a number of times a character appears in a same place across two distinct web shell applications.

5. The method of claim 1 , wherein at least one of the first plurality of descriptive features relates to a distribution of characters in at least one the known web shell application.

6. The method of claim 1 , wherein at least one of the first plurality of descriptive features is a string-comment ratio of the known web shell application.

7. The method of claim 1 , wherein at least one of the first plurality of descriptive features is a maximum string length of the known web shell application.

8. The method of claim 1 , wherein at least one of the second plurality of descriptive features includes attempted system calls or attempted network connections.

9. The method of claim 1 , wherein generating the machine learning model includes identifying probabilistic patterns among the first plurality of descriptive features that corresponds to the known web shell application.

10. A system for training a web shell application classifier, the system comprising:

an interface for accessing known web shell application;

a memory; and

a processor executing instructions stored on the memory to:

extract a first plurality of descriptive features describing a known web shell application, wherein the first plurality of descriptive features comprises a static feature relating to a lexical component from content of the known web shell application,

extract a second plurality of descriptive features describing the known web shell application, wherein the second plurality of descriptive features comprises a dynamic feature relating to monitored behavior of the known web shell application when executed, and

generate, based on the first plurality of descriptive features and the second plurality of descriptive features, a machine learning model that determines whether an unknown application file is a web shell application, wherein the generated model outputs, for each respective feature of a third plurality of descriptive features of the unknown application file, a respective vote of whether the respective feature indicates the unknown application file is a web shell application, and wherein the respective votes are aggregated to provide an overall result of whether the unknown application file is a web shell application.

11. The system of claim 10 , wherein the interface is further configured to access at least one known non-web shell application, and the processor is further configured to extract at least one descriptive feature describing each of the at least one known non-web shell application and generate the machine learning model based also on the at least one descriptive feature of the at least one known non-web shell application.

12. The system of claim 10 , wherein at least one of the first plurality of descriptive features includes a token variable, an assignment operator, or a statement-ending character.

13. The system of claim 10 , wherein at least one of the first plurality of descriptive features includes a number of times a character appears in a same place across two distinct web shell applications.

14. The system of claim 10 , wherein at least one of the first plurality of descriptive features relates to a distribution of characters in the known web shell application.

15. The system of claim 10 , wherein at least one of the first plurality of descriptive features is a string-comment ratio of the known web shell application.

16. The system of claim 10 , wherein at least one of the first plurality of descriptive features is a maximum string length of the known web shell application.

17. The system of claim 10 , wherein at least one of the second plurality of descriptive features includes attempted system calls or attempted network connections.

18. The system of claim 10 , wherein the processor generates the machine learning model by identifying probabilistic patterns among the first plurality of descriptive features that corresponds to the known web shell application.