This is a collection of machine learning models for detecting malicious WebShell code, fine-tuned on BERT architectures. The repository contains four model variants optimized for different use cases.
1from transformers import AutoTokenizer, AutoModelForSequenceClassification
2import torch
3
4# 选择模型变体 / Choose model variant
5model_name = "null822/webshell-detect-bert"
6subfolder = "full_tinybert_model" # 或其他变体
7
8# 加载模型 / Load model
9tokenizer = AutoTokenizer.from_pretrained(model_name, subfolder=subfolder)
10model = AutoModelForSequenceClassification.from_pretrained(model_name, subfolder=subfolder)
11
12def detect_webshell(code_text):
13 inputs = tokenizer(code_text, return_tensors="pt", truncation=True, max_length=512)
14 with torch.no_grad():
15 outputs = model(**inputs)
16 prediction = torch.argmax(outputs.logits, dim=1).item()
17 return "Malicious WebShell" if prediction == 1 else "Normal Code"
18
19# 示例 / Example
20code = "<?php eval($_POST['cmd']); ?>"
21result = detect_webshell(code)
22print(result) # 输出: Malicious WebShell
1def batch_detect(code_list):
2 results = []
3 for code in code_list:
4 result = detect_webshell(code)
5 results.append(result)
6 return results
7
8# 示例 / Example
9codes = [
10 "<?php echo 'Hello World'; ?>",
11 "<?php eval($_POST['cmd']); ?>",
12 "<?php system($_GET['c']); ?>"
13]
14results = batch_detect(codes)
1def detect_file(file_path):
2 try:
3 with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
4 content = f.read()
5 return detect_webshell(content)
6 except Exception as e:
7 return f"Error reading file: {e}"
8
9# 示例 / Example
10result = detect_file("suspicious_file.php")
1@misc{webshell-detect-bert,
2 title={WebShell Detection Models based on BERT},
3 author={null822},
4 year={2025},
5 publisher={Hugging Face},
6 howpublished={\url{https://huggingface.co/null822/webshell-detect-bert}}
7}
