{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,22]],"date-time":"2026-01-22T08:14:13Z","timestamp":1769069653370,"version":"3.49.0"},"reference-count":52,"publisher":"Springer Science and Business Media LLC","issue":"8","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"},{"start":{"date-parts":[[2025,10,14]],"date-time":"2025-10-14T00:00:00Z","timestamp":1760400000000},"content-version":"vor","delay-in-days":13,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0"}],"funder":[{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282025044"],"award-info":[{"award-number":["3282025044"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282024050"],"award-info":[{"award-number":["3282024050"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282024021"],"award-info":[{"award-number":["3282024021"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"China University Innovation Fund","award":["20221T013"],"award-info":[{"award-number":["20221T013"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J. King Saud Univ. Comput. Inf. Sci."],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1007\/s44443-025-00235-8","type":"journal-article","created":{"date-parts":[[2025,10,14]],"date-time":"2025-10-14T15:29:34Z","timestamp":1760455774000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Incremental learning research for webshell detection"],"prefix":"10.1007","volume":"37","author":[{"given":"Zhiqiang","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shaowei","family":"Yuan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiang","family":"Tian","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,10,14]]},"reference":[{"key":"235_CR1","doi-asserted-by":"publisher","first-page":"75785","DOI":"10.1109\/ACCESS.2020.2989304","volume":"8","author":"Z Ai","year":"2020","unstructured":"Ai Z, Luktarhan N, Zhao Y, Tang C (2020) Ws-lsmr: malicious webshell detection algorithm based on ensemble learning. IEEE Access 8:75785\u201375797","journal-title":"IEEE Access"},{"key":"235_CR2","doi-asserted-by":"crossref","unstructured":"Akiba T, Sano S, Yanase T, Ohta T, Koyama M (2019) Optuna: A Automatic Hyperparameter Optimization Framework. https:\/\/optuna.org\/","DOI":"10.1145\/3292500.3330701"},{"key":"235_CR3","doi-asserted-by":"publisher","unstructured":"An T, Shui X, Gao H (2022) Deep learning based webshell detection coping with long text and lexical ambiguity. In: Alcaraz C, Chen L (eds) Information and communications security: 24th International Conference, ICICS 2022, Canterbury, UK, September 5\u20138, 2022, Proceedings. Lecture notes in computer science, vol 13407. Springer, Cham, pp 438\u2013457. https:\/\/doi.org\/10.1007\/978-3-031-15777-6_24","DOI":"10.1007\/978-3-031-15777-6_24"},{"key":"235_CR4","unstructured":"Beltagy I, Peters ME, Cohan A (2020) Longformer: the long-document transformer. arXiv preprint arXiv:2004.05150"},{"key":"235_CR5","doi-asserted-by":"publisher","first-page":"135","DOI":"10.1162\/tacl_a_00051","volume":"5","author":"P Bojanowski","year":"2017","unstructured":"Bojanowski P, Grave E, Joulin A, Mikolov T (2017) Enriching word vectors with subword information. Trans Assoc Comput Linguist 5:135\u2013146","journal-title":"Trans Assoc Comput Linguist"},{"key":"235_CR6","doi-asserted-by":"publisher","unstructured":"Cheng B, Guo Y, Ren Y, Yang G, Xu G (2022) MSDetector: a static PHP webshell detection system based on deep-learning. In: A\u00eft-Ameur Y, Cr\u0103ciun F (eds) Theoretical aspects of software engineering: 16th international symposium, TASE 2022, Cluj-Napoca, Romania, July 8\u201310, 2022, Proceedings. Lecture notes in computer science, vol 13299. Springer, Cham, pp 155\u2013172. https:\/\/doi.org\/10.1007\/978-3-031-10363-6_12","DOI":"10.1007\/978-3-031-10363-6_12"},{"key":"235_CR7","doi-asserted-by":"publisher","first-page":"30852","DOI":"10.1109\/ACCESS.2024.3368436","volume":"12","author":"G Cho","year":"2024","unstructured":"Cho G, Choi YS (2024) Image super-resolution with unified-window attention. IEEE Access 12:30852\u201330866","journal-title":"IEEE Access"},{"key":"235_CR8","unstructured":"Cyc1e183 (2020) PHP-Webshell-Dataset. https:\/\/github.com\/Cyc1e183\/PHP-Webshell-Dataset"},{"key":"235_CR9","unstructured":"CyCognito (2024) 2024 state of web application security testing: The need to improve testing and remediation effectiveness. https:\/\/www.cycognito.com\/"},{"key":"235_CR10","unstructured":"D99net (2025) D-shield. https:\/\/www.d99net.net\/"},{"issue":"8","key":"235_CR11","doi-asserted-by":"publisher","first-page":"1482","DOI":"10.3390\/electronics13081482","volume":"13","author":"C Dong","year":"2024","unstructured":"Dong C, Li D (2024) Ast-df: A new webshell detection method based on abstract syntax tree and deep forest. Electronics 13(8):1482","journal-title":"Electronics"},{"key":"235_CR12","doi-asserted-by":"publisher","unstructured":"Fang Y, Qiu Y, Liu L, Huang C (2018) Detecting webshell based on random forest with fasttext. In: ICCAI '18: proceedings of the 2018 international conference on computing and artificial intelligence, Chengdu, China, March 12\u201314, 2018. ACM, New York, pp 52\u201356. https:\/\/doi.org\/10.1145\/3194452.3194470","DOI":"10.1145\/3194452.3194470"},{"key":"235_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110406","volume":"245","author":"P Feng","year":"2024","unstructured":"Feng P, Wei D, Li Q, Wang Q, Hu Y, Xi N, Ma J (2024) GlareShell: graph learning-based PHP webshell detection for web server of industrial internet. Comput Networks 245:110406","journal-title":"Comput Networks"},{"key":"235_CR14","doi-asserted-by":"crossref","unstructured":"Feng Z, Guo D, Tang D, Duan N, Feng X, Gong M, Shou L, Qin B, Liu T, Jiang D (2020) Codebert: a pre-trained model for programming and natural languages. arXiv preprint arXiv:2002.08155","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"issue":"1","key":"235_CR15","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1007\/s10207-022-00615-5","volume":"22","author":"A Hannousse","year":"2023","unstructured":"Hannousse A, Nait-Hamoud MC, Yahiouche S (2023) A deep learner model for multi-language webshell detection. Int J Inf Secur 22(1):47\u201361","journal-title":"Int J Inf Secur"},{"key":"235_CR16","unstructured":"Hannousse (2021) Cleaned-PHP-Webshell-dataset. https:\/\/github.com\/hannousse\/Cleaned-PHP-Webshell-dataset"},{"key":"235_CR17","unstructured":"Husain H, Wu H-H, Gazit T, Allamanis M, Brockschmidt M (2019) Codesearchnet challenge: Evaluating the state of semantic code search. arXiv preprint arXiv:1909.09436"},{"issue":"2","key":"235_CR18","first-page":"229","volume":"11","author":"J Kim","year":"2015","unstructured":"Kim J, Yoo D-H, Jang H, Jeong K (2015) WebSHark 1.0: a benchmark collection for malicious web shell detection. J Inf Process Syst 11(2):229\u2013238","journal-title":"J Inf Process Syst"},{"issue":"13","key":"235_CR19","doi-asserted-by":"publisher","first-page":"3521","DOI":"10.1073\/pnas.1611835114","volume":"114","author":"J Kirkpatrick","year":"2017","unstructured":"Kirkpatrick J, Pascanu R, Rabinowitz N, Veness J, Desjardins G, Rusu AA, Milan K, Quan J, Ramalho T, Grabska-Barwinska A (2017) Overcoming catastrophic forgetting in neural networks. Proc Natl Acad Sci U S A 114(13):3521\u20133526","journal-title":"Proc Natl Acad Sci U S A"},{"issue":"2","key":"235_CR20","first-page":"2630","volume":"24","author":"HV Le","year":"2021","unstructured":"Le HV, Nguyen TN, Nguyen HN, Le L (2021) An efficient hybrid webshell detection method for webserver of marine transportation systems. IEEE Trans Intell Transp Syst 24(2):2630\u20132642","journal-title":"IEEE Trans Intell Transp Syst"},{"key":"235_CR21","unstructured":"Le Q, Mikolov T (2014) Distributed representations of sentences and documents. In: Proceedings of the 31st international conference on machine learning (ICML 2014), Beijing, China, June 21\u201326, 2014. Proceedings of machine learning research, vol 32, issue no. 2. PMLR, pp 1188\u20131196"},{"key":"235_CR22","unstructured":"Le HV (2021) HRDWD: Hybrid Rule-based Deep Webshell Detection [Source code]. https:\/\/github.com\/levietha0311\/HRDWD"},{"key":"235_CR23","doi-asserted-by":"publisher","unstructured":"Lee HJ, Hwang SJ, Pratiwi M, Choi Y-H (2024) Obfuscated PHP webshell detection using the webshell tailored textrank algorithm. In: SAC '24: proceedings of the 39th ACM\/SIGAPP symposium on applied computing, Avila, Spain, April 8\u201312, 2024. ACM, New York, pp 1358\u20131365. https:\/\/doi.org\/10.1145\/3605098.3635940","DOI":"10.1145\/3605098.3635940"},{"issue":"12","key":"235_CR24","first-page":"2935","volume":"40","author":"Z Li","year":"2017","unstructured":"Li Z, Hoiem D (2017) Learning without forgetting. ITPAM 40(12):2935\u20132947","journal-title":"ITPAM"},{"key":"235_CR25","doi-asserted-by":"publisher","first-page":"185140","DOI":"10.1109\/ACCESS.2019.2959950","volume":"7","author":"T Li","year":"2019","unstructured":"Li T, Ren C, Fu Y, Xu J, Guo J, Chen X (2019a) Webshell detection based on the word attention mechanism. IEEE Access 7:185140\u2013185147","journal-title":"IEEE Access"},{"key":"235_CR26","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.101595","volume":"87","author":"Y Li","year":"2019","unstructured":"Li Y, Huang J, Ikusan A, Mitchell M, Zhang J, Dai R (2019b) Shellbreaker: automatically detecting php-based malicious web shells. Comput Secur 87:101595","journal-title":"Comput Secur"},{"key":"235_CR27","doi-asserted-by":"publisher","unstructured":"Liang X, Tang Z, Li J, Zhang M (2023) Open-ended long text generation via masked language modeling. In: Proceedings of the 61st annual meeting of the association for computational linguistics, vol 1. Long Papers, Toronto, Canada, July 9\u201314, 2023. Association for Computational Linguistics, Stroudsburg, pp 223\u2013241. https:\/\/doi.org\/10.18653\/v1\/2023.acl-long.13","DOI":"10.18653\/v1\/2023.acl-long.13"},{"issue":"1","key":"235_CR28","volume":"2022","author":"Z Liu","year":"2022","unstructured":"Liu Z, Li D, Wei L (2022) A new method for webshell detection based on bidirectional gru and attention mechanism. Secur Commun Networks 2022(1):3434920","journal-title":"Secur Commun Networks"},{"issue":"3","key":"235_CR29","doi-asserted-by":"publisher","first-page":"766","DOI":"10.26599\/TST.2023.9010020","volume":"29","author":"X Liu","year":"2023","unstructured":"Liu X, Zhang Y, Yu Q, Min J, Shen J, Zhou R, Zhou Q (2023) Smarteagleeye: a cloud-oriented webshell detection system based on dynamic gray-box and deep learning. Tsinghua Sci Technol 29(3):766\u2013783","journal-title":"Tsinghua Sci Technol"},{"key":"235_CR30","unstructured":"Liu Y, Ott M, Goyal N, Du J, Joshi M, Chen D, Levy O, Lewis M, Zettlemoyer L, Stoyanov V (2019) Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692:"},{"issue":"12","key":"235_CR31","first-page":"2346","volume":"31","author":"J Lu","year":"2018","unstructured":"Lu J, Liu A, Dong F, Gu F, Gama J, Zhang G (2018) Learning under concept drift: a review. IEEE Trans Knowl Data Eng 31(12):2346\u20132363","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"235_CR32","unstructured":"Ma M, Han L, Zhou C (2024) Large language models are few-shot generators: proposing hybrid prompt algorithm to generate webshell escape samples. arXiv preprint arXiv:2402.07408:"},{"key":"235_CR33","unstructured":"Ma M, Han L, Zhou C (2024) Research and application of artificial intelligence based webshell detection model: a literature review. arXiv preprint arXiv:2405.00066"},{"key":"235_CR34","unstructured":"Mikolov T, Chen K, Corrado G, Dean J (2013) Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781"},{"key":"235_CR35","unstructured":"MITREATT & CK (2024) Webshell (T1505.003). https:\/\/attack.mitre.org\/techniques\/T1505\/003\/"},{"key":"235_CR36","unstructured":"NBS System (2022) PHP Malware Finder. https:\/\/github.com\/nbs-system\/php-malware-finder"},{"issue":"1","key":"235_CR37","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/5533963","volume":"2021","author":"Z Pan","year":"2021","unstructured":"Pan Z, Chen Y, Chen Y, Shen Y, Guo X (2021) Webshell detection based on executable data characteristics of php code. Wirel Commun Mob Comput 2021(1):5533963","journal-title":"Wirel Commun Mob Comput"},{"key":"235_CR38","doi-asserted-by":"publisher","unstructured":"Pennington J, Socher R, Manning CD (2014) GloVe: global vectors for word representation. In: Proceedings of the 2014 conference on empirical methods in natural language processing (EMNLP 2014), Doha, Qatar, October 25\u201329, 2014. Association for Computational Linguistics, Stroudsburg, pp 1532\u20131543. https:\/\/doi.org\/10.3115\/v1\/D14-1162","DOI":"10.3115\/v1\/D14-1162"},{"key":"235_CR39","unstructured":"Ren L, Liu Y, Lu Y, Shen Y, Liang C, Chen W (2024) Samba: Simple hybrid state space models for efficient unlimited context language modeling. arXiv preprint arXiv:2406.07522"},{"key":"235_CR40","unstructured":"Rethans D (2022) Vulcan logic dumper (VLD) [PHP extension, Version 0.18.0 beta].\u00a0https:\/\/pecl.php.net\/package\/vld"},{"key":"235_CR41","unstructured":"ShellPub (2024) PHP Webshell Detection. https:\/\/n.shellpub.com\/en"},{"key":"235_CR42","unstructured":"StationX (2024) 2024 Malware Statistics Report. https:\/\/www.stationx.net\/malware-statistics\/"},{"key":"235_CR43","unstructured":"Talos Intelligence (2024) Talos IR trends Q4 2024: Webshell usage and exploitation of public-facing applications spike. https:\/\/blog.talosintelligence.com\/talos-ir-trends-q4-2024\/"},{"key":"235_CR44","unstructured":"Tennc (2024) webshell. https:\/\/github.com\/tennc\/webshell"},{"issue":"12","key":"235_CR45","doi-asserted-by":"publisher","first-page":"1185","DOI":"10.1038\/s42256-022-00568-3","volume":"4","author":"GM Van de Ven","year":"2022","unstructured":"Van de Ven GM, Tuytelaars T, Tolias AS (2022) Three types of incremental learning. Nat Mach Intell 4(12):1185\u20131197","journal-title":"Nat Mach Intell"},{"key":"235_CR46","unstructured":"W3Techs (2024) Usage statistics of server-side programming languages for websites. https:\/\/w3techs.com\/technologies\/details\/pl-php"},{"key":"235_CR47","volume":"62","author":"C Wang","year":"2024","unstructured":"Wang C, Zhang X, Yang W, Wang G, Li X, Wang J, Lu B (2024) MSWAGAN: multi-spectral remote sensing image super resolution based on multi-scale window attention transformer. IEEE Trans Geosci Remote Sens 62:5404715","journal-title":"IEEE Trans Geosci Remote Sens"},{"key":"235_CR48","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104049","volume":"146","author":"B Xie","year":"2024","unstructured":"Xie B, Li Q, Wang Y (2024) PHP-based malicious webshell detection based on abstract syntax tree simplification and explicit duration recurrent networks. Comput Secur 146:104049","journal-title":"Comput Secur"},{"issue":"5","key":"235_CR49","first-page":"6575","volume":"45","author":"L Yuan","year":"2022","unstructured":"Yuan L, Hou Q, Jiang Z, Feng J, Yan S (2022) Volo: vision outlooker for visual recognition. ITPAM 45(5):6575\u20136586","journal-title":"ITPAM"},{"issue":"3","key":"235_CR50","doi-asserted-by":"publisher","first-page":"416","DOI":"10.3390\/electronics14030416","volume":"14","author":"Y Zhang","year":"2025","unstructured":"Zhang Y, Kang H, Wang Q (2025) Mmfdectect: webshell evasion detect method based on multimodal feature fusion. Electronics 14(3):416","journal-title":"Electronics"},{"issue":"1","key":"235_CR51","doi-asserted-by":"publisher","first-page":"47","DOI":"10.1016\/j.visinf.2023.06.008","volume":"8","author":"Y Zhao","year":"2024","unstructured":"Zhao Y, Lv S, Long W, Fan Y, Yuan J, Jiang H, Zhou F (2024) Malicious webshell family dataset for webshell multi-classification research. Vis Inform 8(1):47\u201355","journal-title":"Vis Inform"},{"key":"235_CR52","doi-asserted-by":"crossref","unstructured":"Zhou Z, Li L, Zhao X (2021) Webshell detection technology based on deep learning. In: 2021 7th IEEE Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing,(HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS), pp 52\u201356","DOI":"10.1109\/BigDataSecurityHPSCIDS52275.2021.00020"}],"container-title":["Journal of King Saud University Computer and Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s44443-025-00235-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s44443-025-00235-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s44443-025-00235-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,29]],"date-time":"2025-10-29T15:39:18Z","timestamp":1761752358000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s44443-025-00235-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":52,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2025,10]]}},"alternative-id":["235"],"URL":"https:\/\/doi.org\/10.1007\/s44443-025-00235-8","relation":{},"ISSN":["1319-1578","2213-1248"],"issn-type":[{"value":"1319-1578","type":"print"},{"value":"2213-1248","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10]]},"assertion":[{"value":"10 June 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 August 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 October 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"None.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"249"}}