Handling webshell attacks: A systematic mapping and survey. Issue 108 (September 2021)

• Record Type: Journal Article
• Authors: Hannousse, Abdelhakim; Yahiouche, Salima
• Is Part Of: Computers & security. Issue 108(2021)
• Publication Date: 2021-09
• Subjects: Cybersecurity -- Webshell attack -- Systematic mapping -- Survey; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102366
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: In recent years, there has been a significant increase in research interest in webshell attacks. Webshells are pieces of code that can be written in different scripting languages. They are uploaded to web servers after creating a breach making use of injection vulnerabilities. Webshells provide hackers a web interface to remotely execute commands, manipulate confidential data and invade web servers. The aim of this study is to provide researchers and practitioners with a holistic view of existing studies, approaches, techniques and tools for the detection of webshells and highlight potential gaps. To achieve this goal, a systematic mapping study is conducted. Forty-four primary studies are identified, surveyed and categorized following their scope of interest. Collections of malicious and benign webshells useful for validation and testing are identified. We also provide an overview of existing tools used for webshell detection with their limitations. Our findings revealed biases toward PHP webshells and machine learning technology as detection method. The study also revealed the need for more comprehensive studies and benchmark datasets for proper validation.