{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T15:24:22Z","timestamp":1772119462726,"version":"3.50.1"},"reference-count":49,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2025,6,21]],"date-time":"2025-06-21T00:00:00Z","timestamp":1750464000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,6,21]],"date-time":"2025-06-21T00:00:00Z","timestamp":1750464000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100012659","name":"Foundation for Innovative Research Groups of the National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62466035"],"award-info":[{"award-number":["62466035"]}],"id":[{"id":"10.13039\/501100012659","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012659","name":"Foundation for Innovative Research Groups of the National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62466035"],"award-info":[{"award-number":["62466035"]}],"id":[{"id":"10.13039\/501100012659","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2025,8]]},"DOI":"10.1007\/s10207-025-01078-0","type":"journal-article","created":{"date-parts":[[2025,6,21]],"date-time":"2025-06-21T08:49:13Z","timestamp":1750495753000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Webshell detection method based on feature fusion and federated learning"],"prefix":"10.1007","volume":"24","author":[{"given":"Zeng","family":"Qing-peng","sequence":"first","affiliation":[]},{"given":"Chai","family":"Jiang-li","sequence":"additional","affiliation":[]},{"given":"Wu","family":"Jian-sheng","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,6,21]]},"reference":[{"key":"1078_CR1","unstructured":"Trend Micro. Rethinking Tactics:2022 Annual Cybersecurity Report. [online], available: (2023). https:\/\/documents.trendmicro.com\/assets\/rpt\/rpt-rethinking-tactics-annual-cybersecurity-roundup-2022.pdf"},{"key":"1078_CR2","unstructured":"Cisco Talos. Quarterly Report: Incident Response Trends in Q1 2023. [online], available: (2023). https:\/\/blog.talosintelligence.com\/quarterly-report-incident-response-trends-in-q1-2023\/"},{"key":"1078_CR3","unstructured":"Ma, M.R, Han, L.S, Zhou, C.J: Research and application of artificial intelligence based webshell detection model: A literature review. arXiv preprint arXiv:2405.00066, (2024)"},{"key":"1078_CR4","first-page":"103721","volume":"82","author":"J Tang","year":"2024","unstructured":"Tang, J., Xu, W., Peng, T., et al.: Android malware detection based on a novel mixed bytecode image combined with attention mechanism. J. Inform. Secur. Appl. 82, 103721 (2024)","journal-title":"J. Inform. Secur. Appl."},{"key":"1078_CR5","doi-asserted-by":"publisher","first-page":"102366","DOI":"10.1016\/j.cose.2021.102366","volume":"108","author":"A Hannousse","year":"2021","unstructured":"Hannousse, A., Yahiouche, S.: Handling webshell attacks: a systematic mapping and survey. Comput. Secur. 108, 102366 (2021)","journal-title":"Comput. Secur."},{"key":"1078_CR6","doi-asserted-by":"publisher","first-page":"102526","DOI":"10.1016\/j.jnca.2019.102526","volume":"153","author":"D Gibert","year":"2020","unstructured":"Gibert, D., Mateu, C., Planes, J.: The rise of machine learning for detection and classification of malware: research developments, trends and challenges. J. Netw. Comput. Appl. 153, 102526 (2020)","journal-title":"J. Netw. Comput. Appl."},{"key":"1078_CR7","doi-asserted-by":"publisher","first-page":"3977","DOI":"10.1109\/TIFS.2023.3287395","volume":"18","author":"WB Fang","year":"2023","unstructured":"Fang, W.B., He, J.J., Li, W.S., et al.: Comprehensive android malware detection based on federated learning architecture. IEEE Trans. Inf. Forensics Secur. 18, 3977\u20133990 (2023)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"4","key":"1078_CR8","doi-asserted-by":"publisher","first-page":"3347","DOI":"10.1109\/TKDE.2021.3124599","volume":"35","author":"Q Li","year":"2021","unstructured":"Li, Q., Wen, Z., Wu, Z., et al.: A survey on federated learning systems: Vision, hype and reality for data privacy and protection. IEEE Trans. Knowl. Data Eng. 35(4), 3347\u20133366 (2021)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"3","key":"1078_CR9","doi-asserted-by":"publisher","first-page":"33687","DOI":"10.1109\/ACCESS.2024.3372394","volume":"12","author":"G Sun","year":"2024","unstructured":"Sun, G., Shu, H., Shao, F., et al.: FKD-med: privacy-aware, communication-optimized medical image segmentation via federated learning and model lightweighting through knowledge distillation. IEEE Access 12(3), 33687\u201333704 (2024)","journal-title":"IEEE Access"},{"issue":"4","key":"1078_CR10","doi-asserted-by":"publisher","first-page":"103097","DOI":"10.1016\/j.cose.2023.103097","volume":"127","author":"O Friha","year":"2023","unstructured":"Friha, O., Ferrag, M.A., Benbouzid, M., et al.: 2DF-IDS: decentralized and differentially private federated learning-based intrusion detection system for industrial IoT. Comput. Secur. 127(4), 103097 (2023)","journal-title":"Comput. Secur."},{"key":"1078_CR11","doi-asserted-by":"crossref","unstructured":"Liu, Z, Sun, H, Song, J, et al.: Vertical Federated Learning Architecture for Power Company and Financial Company and Electricity Pricing Model Considering User Credit Evaluation[C]\/\/2023 3rd International Conference on Consumer Electronics and Computer Engineering (ICCECE). IEEE, (2023): 820\u2013826.","DOI":"10.1109\/ICCECE58074.2023.10135197"},{"issue":"3","key":"1078_CR12","first-page":"91","volume":"10","author":"F Yang","year":"2024","unstructured":"Yang, F., Sun, Y., Chen, X.Y., et al.: Verifiable federated aggregation method based on homomorphic proxy re-authentication. Chin. J. Netw. Inform. Secur. 10(3), 91\u2013106 (2024)","journal-title":"Chin. J. Netw. Inform. Secur."},{"issue":"1","key":"1078_CR13","doi-asserted-by":"publisher","first-page":"486","DOI":"10.1109\/TDSC.2023.3263507","volume":"21","author":"A Sarmadi","year":"2023","unstructured":"Sarmadi, A., Fu, H., Krishnamurthy, P., et al.: Privacy-preserving collaborative learning through feature extraction. IEEE Trans. Dependable Secure Comput. 21(1), 486\u2013498 (2023)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"1078_CR14","doi-asserted-by":"crossref","unstructured":"Kim, Y.: Convolutional Neural Networks for Sentence Classification [J].arXiv preprint arXiv:1408.5882, (2014).","DOI":"10.3115\/v1\/D14-1181"},{"key":"1078_CR15","doi-asserted-by":"publisher","first-page":"104390","DOI":"10.1016\/j.cose.2025.104390","volume":"153","author":"ZX Chen","year":"2025","unstructured":"Chen, Z.X., Wang, W.P., Qin, Y., et al.: ZipAST: Enhancing malicious JavaScript detection with sequence compression. Comput. Secur. 153, 104390 (2025)","journal-title":"Comput. Secur."},{"key":"1078_CR16","first-page":"52","volume":"2018","author":"Y Fang","year":"2018","unstructured":"Fang, Y., Qiu, Y., Liu, L., et al.: Detecting webshell based on random forest with fasttext[C]\/\/Proceedings of the. Int. Conf. Comput. Artif. Intell.. 2018, 52\u201356 (2018)","journal-title":"Int. Conf. Comput. Artif. Intell.."},{"key":"1078_CR17","unstructured":"Mcmahan, B., Moore, E., Ramage, D., et al.: Communication-efficient learning of deep networks from decentralized data[C]\/\/Artificial intelligence and statistics. PMLR, (2017) 1273\u20131282."},{"key":"1078_CR18","doi-asserted-by":"crossref","unstructured":"Croix, A., Debatty, T., Mees, W.: Training a multi-criteria decision system and application to the detection of PHP webshells[C]\/\/2019 International Conference on Military Communications and Information Systems (ICMCIS). IEEE, (2019): 1\u20138.","DOI":"10.1109\/ICMCIS.2019.8842705"},{"key":"1078_CR19","first-page":"103451","volume":"74","author":"M Alaeiyan","year":"2023","unstructured":"Alaeiyan, M., Parsa, S., Vinod, P.: Sober: explores for invasive behaviour of malware. J. Inform. Secur. Appl. 74, 103451 (2023)","journal-title":"J. Inform. Secur. Appl."},{"issue":"3","key":"1078_CR20","first-page":"118","volume":"15","author":"K Suwais","year":"2023","unstructured":"Suwais, K., Hnaif, A.A., Almanasra, S.: An alternative static taint analysis framework to detect php web shell-based web attacks. Int. J. Adv. Soft Comput. Appl. 15(3), 118\u2013131 (2023)","journal-title":"Int. J. Adv. Soft Comput. Appl."},{"issue":"16","key":"1078_CR21","doi-asserted-by":"publisher","first-page":"7763","DOI":"10.3390\/app11167763","volume":"11","author":"JZ Zhao","year":"2021","unstructured":"Zhao, J.Z., Lu, Y.L., Wang, X., et al.: WTA: a static taint analysis framework for PHP Webshell. Appl. Sci. 11(16), 7763 (2021)","journal-title":"Appl. Sci."},{"issue":"1","key":"1078_CR22","doi-asserted-by":"publisher","first-page":"12","DOI":"10.3390\/fi12010012","volume":"12","author":"Y Guo","year":"2020","unstructured":"Guo, Y., Marco-Gisbert, H., Keir, P.: Mitigating Webshell attacks through machine learning techniques. Future Internet 12(1), 12 (2020)","journal-title":"Future Internet"},{"issue":"8","key":"1078_CR23","doi-asserted-by":"publisher","first-page":"1482","DOI":"10.3390\/electronics13081482","volume":"13","author":"C Dong","year":"2024","unstructured":"Dong, C., Li, D.: AST-DF: a new webshell detection method based on abstract syntax tree and deep forest. Electronics 13(8), 1482 (2024)","journal-title":"Electronics"},{"issue":"6","key":"1078_CR24","doi-asserted-by":"publisher","first-page":"e4085","DOI":"10.1002\/ett.4085","volume":"33","author":"B Yong","year":"2022","unstructured":"Yong, B., Wei, W., Li, K.C., et al.: Ensemble machine learning approaches for Webshell detection in Internet of things environments. Trans. Emerg. Telecommun. Technol. 33(6), e4085 (2022)","journal-title":"Trans. Emerg. Telecommun. Technol."},{"issue":"6","key":"1078_CR25","first-page":"125","volume":"36","author":"F Lin","year":"2020","unstructured":"Lin, F., Xu, L.J., Chen, X.H., et al.: Method of Webshell detection based on multi-view feature fusion. Telecommun. Sci. 36(6), 125\u2013132 (2020)","journal-title":"Telecommun. Sci."},{"key":"1078_CR26","doi-asserted-by":"publisher","first-page":"104049","DOI":"10.1016\/j.cose.2024.104049","volume":"146","author":"BL Xie","year":"2024","unstructured":"Xie, B.L., Li, Q., Wang, Y.: PHP-based malicious webshell detection based on abstract syntax tree simplification and explicit duration recurrent networks. Comput. Secur. 146, 104049 (2024)","journal-title":"Comput. Secur."},{"key":"1078_CR27","doi-asserted-by":"crossref","unstructured":"Wang, G.Y., Ko, H.J., Chiang, C.P., et al.: Webshell detection based on codebert and deep learning model[C]\/\/Proceedings of the 2024 5th International Conference on Computing, Networks and Internet of Things. (2024): 484\u2013489.","DOI":"10.1145\/3670105.3670190"},{"key":"1078_CR28","doi-asserted-by":"crossref","unstructured":"Wu, Y.L., Song, M.L., Li, Y.K., et al.: Improving convolutional neural network-based webshell detection through reinforcement learning[C]\/\/Information and Communications Security: 23rd International Conference, ICICS 2021, Chongqing, China, November 19\u201321, 2021, Proceedings, Part I 23. Springer International Publishing, (2021): 368\u2013383.","DOI":"10.1007\/978-3-030-86890-1_21"},{"key":"1078_CR29","unstructured":"Lipton, Z.C.: A Critical Review of Recurrent Neural Networks for Sequence Learning. arXiv Preprint, CoRR, abs\/1506.00019, (2015)."},{"issue":"4","key":"1078_CR30","doi-asserted-by":"publisher","first-page":"2583","DOI":"10.1007\/s10207-024-00851-x","volume":"23","author":"MA Elberri","year":"2024","unstructured":"Elberri, M.A., Toke\u015fer, \u00dc., Rahebi, J., et al.: A cyber defense system against phishing attacks with deep learning game theory and LSTM-CNN with African vulture optimization algorithm (AVOA). Int. J. Inf. Secur. 23(4), 2583\u20132606 (2024)","journal-title":"Int. J. Inf. Secur."},{"issue":"3","key":"1078_CR31","doi-asserted-by":"publisher","first-page":"416","DOI":"10.3390\/electronics14030416","volume":"14","author":"Y Zhang","year":"2025","unstructured":"Zhang, Y., Kang, H., Wang, Q.: MMFDetect: Webshell evasion detect method based on multimodal feature fusion. Electronics 14(3), 416 (2025)","journal-title":"Electronics"},{"key":"1078_CR32","doi-asserted-by":"publisher","first-page":"185140","DOI":"10.1109\/ACCESS.2019.2959950","volume":"7","author":"T Li","year":"2019","unstructured":"Li, T., Ren, C., Fu, Y., et al.: Webshell detection based on the word attention mechanism. IEEE Access 7, 185140\u2013185147 (2019)","journal-title":"IEEE Access"},{"issue":"5","key":"1078_CR33","first-page":"68","volume":"4","author":"HK Gao","year":"2022","unstructured":"Gao, H.K., An, T.J., Shui, X.F., et al.: ATWebshell: Webshell detection model based on adversarial learning and long-short semantic awareness. Front. Data Comput. 4(5), 68\u201376 (2022)","journal-title":"Front. Data Comput."},{"key":"1078_CR34","doi-asserted-by":"publisher","first-page":"110406","DOI":"10.1016\/j.comnet.2024.110406","volume":"245","author":"P Feng","year":"2024","unstructured":"Feng, P., Wei, D., Li, Q., et al.: GlareShell: Graph learning-based PHP webshell detection for web server of industrial internet. Comput. Netw. 245, 110406 (2024)","journal-title":"Comput. Netw."},{"key":"1078_CR35","volume-title":"Research of Webshell Detection Algorithm Based on Deep Learning","author":"JH Zhang","year":"2023","unstructured":"Zhang, J.H.: Research of Webshell Detection Algorithm Based on Deep Learning. Nanchang University, Nangchang (2023)"},{"key":"1078_CR36","unstructured":"Yang, Y., Hui, B., Yuan, H., et al.: PrivateFL: Accurate, differentially private federated learning via personalized data transformation[C]\/\/32nd USENIX Security Symposium (USENIX Security 23). Anaheim: USENIX Association, (2023): 1595\u20131612."},{"issue":"4","key":"1078_CR37","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3467981","volume":"2","author":"RA Sater","year":"2021","unstructured":"Sater, R.A., Hamza, A.B.: A federated learning approach to anomaly detection in smart buildings. ACM Trans. Internet of Things 2(4), 1\u201323 (2021)","journal-title":"ACM Trans. Internet of Things"},{"issue":"5","key":"1078_CR38","doi-asserted-by":"publisher","first-page":"3492","DOI":"10.1109\/TII.2021.3107783","volume":"18","author":"L Cui","year":"2021","unstructured":"Cui, L., Qu, Y., Xie, G., et al.: Security and privacy-enhanced federated learning for anomaly detection in IoT infrastructures. IEEE Trans. Industr. Inf. 18(5), 3492\u20133500 (2021)","journal-title":"IEEE Trans. Industr. Inf."},{"issue":"8","key":"1078_CR39","doi-asserted-by":"publisher","first-page":"5615","DOI":"10.1109\/TII.2020.3023430","volume":"17","author":"B Li","year":"2020","unstructured":"Li, B., Wu, Y., Song, J., et al.: DeepFed: Federated deep learning for intrusion detection in industrial cyber\u2013physical systems. IEEE Trans. Industr. Inf. 17(8), 5615\u20135624 (2020)","journal-title":"IEEE Trans. Industr. Inf."},{"issue":"1","key":"1078_CR40","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1007\/s10207-025-00983-8","volume":"24","author":"CD Xuan","year":"2025","unstructured":"Xuan, C.D., Quang, D.B., Quang, V.D.: Large language models based vulnerability detection: How does it enhance performance? Int. J. Inf. Secur. 24(1), 69 (2025)","journal-title":"Int. J. Inf. Secur."},{"key":"1078_CR41","unstructured":"Zend. Zend Engine. [online], available: (2021). https:\/\/www.zend.com"},{"key":"1078_CR42","unstructured":"Tianchi. AMWD\u201922-Alibaba Cloud Security WEBSHELL Text Detection Dataset. [online], available: (2022). https:\/\/tianchi.aliyun.com\/dataset\/ 146669"},{"issue":"3","key":"1078_CR43","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","volume":"27","author":"CE Shannon","year":"1948","unstructured":"Shannon, C.E.: A mathematical theory of communication. Bell Syst. Tech. J. 27(3), 379\u2013423 (1948)","journal-title":"Bell Syst. Tech. J."},{"key":"1078_CR44","first-page":"308","volume":"2016","author":"M Abadi","year":"2016","unstructured":"Abadi, M., Chu, A., Goodfellow, I., et al.: Deep learning with differential privacy[C]\/\/Proceedings of the. ACM SIGSAC Conf. Comput. Commun. Secur. 2016, 308\u2013318 (2016)","journal-title":"ACM SIGSAC Conf. Comput. Commun. Secur."},{"key":"1078_CR45","volume-title":"Information theory, inference and learning algorithms","author":"DJC Mackay","year":"2003","unstructured":"Mackay, D.J.C.: Information theory, inference and learning algorithms. Cambridge University Press, United Kingdom (2003)"},{"key":"1078_CR46","doi-asserted-by":"crossref","unstructured":"Zhang, H., Liu, M., Yue, Z., et al.: A php and jsp web shell detection system with text processing based on machine learning[C]\/\/2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, (2020): 1584\u20131591.","DOI":"10.1109\/TrustCom50675.2020.00219"},{"issue":"1","key":"1078_CR47","first-page":"3434920","volume":"2022","author":"Z Liu","year":"2022","unstructured":"Liu, Z., Li, D., Wei, L.: A new method for webshell detection based on bidirectional gru and attention mechanism. Secur. Commun. Netw. 2022(1), 3434920 (2022)","journal-title":"Secur. Commun. Netw."},{"issue":"1","key":"1078_CR48","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1007\/s10207-022-00615-5","volume":"22","author":"A Hannousse","year":"2023","unstructured":"Hannousse, A., Nait-Hamoud, M.C., Yahiouche, S.: A deep learner model for multi-language Webshell detection. Int. J. Inf. Secur. 22(1), 47\u201361 (2023)","journal-title":"Int. J. Inf. Secur."},{"key":"1078_CR49","doi-asserted-by":"crossref","unstructured":"Li, Q., Diao, Y., Chen, Q., et al.: Federated learning on non-iid data silos: An experimental study[C]\/\/2022 IEEE 38th international conference on data engineering (ICDE). IEEE, 2022: 965\u2013978.","DOI":"10.1109\/ICDE53745.2022.00077"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-01078-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-025-01078-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-025-01078-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T11:32:36Z","timestamp":1757071956000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-025-01078-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,21]]},"references-count":49,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2025,8]]}},"alternative-id":["1078"],"URL":"https:\/\/doi.org\/10.1007\/s10207-025-01078-0","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-5748302\/v1","asserted-by":"object"}]},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,21]]},"assertion":[{"value":"2 June 2025","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 June 2025","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"161"}}