{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T21:56:07Z","timestamp":1757627767178,"version":"3.44.0"},"reference-count":36,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,7,2]],"date-time":"2025-07-02T00:00:00Z","timestamp":1751414400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,7,2]],"date-time":"2025-07-02T00:00:00Z","timestamp":1751414400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,7,2]]},"DOI":"10.1109\/iwqos65803.2025.11143530","type":"proceedings-article","created":{"date-parts":[[2025,9,9]],"date-time":"2025-09-09T17:29:52Z","timestamp":1757438992000},"page":"1-10","source":"Crossref","is-referenced-by-count":0,"title":["Distilling Benign Knowledge with Fine-Grained AST Fragments for Precise Real-World Web Shell Detection"],"prefix":"10.1109","author":[{"given":"Mingzhe","family":"Gao","sequence":"first","affiliation":[{"name":"Alibaba Cloud Computing, Southeast University"}]},{"given":"Ligeng","family":"Chen","sequence":"additional","affiliation":[{"name":"Honor Device Co., Ltd, Nanjing University"}]},{"given":"Yiling","family":"He","sequence":"additional","affiliation":[{"name":"University College,London"}]},{"given":"Yuhang","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Southeast University"}]},{"given":"Lingyun","family":"Ying","sequence":"additional","affiliation":[{"name":"QI-ANXIN Technology Research Institute"}]},{"given":"Wang","family":"Yang","sequence":"additional","affiliation":[{"name":"Alibaba Cloud Computing, Southeast University"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Continuous learning for android malware detection","volume-title":"in 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9\u201311, 2023, J. A. Calandrino and C. Troncoso, Eds. USENIX Association","author":"Chen","year":"2023"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616599"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417291"},{"key":"ref4","article-title":"Atropos: Effective fuzzing of web applications for server-side vulnerabilities","volume-title":"USENIX Security Symposium","author":"G\u00fcler","year":"2024"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.241032"},{"key":"ref6","volume-title":"The real reason why malware detection is hard-and underestimated","year":"2022"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363199"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559391"},{"key":"ref9","first-page":"161","article-title":"Mistrust plugins you must: A large-scale study of malicious plugins in wordpress marketplaces","volume-title":"in 31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10\u201312, 2022, K. R. B. Butler and K. Thomas, Eds. USENIX Association","author":"Kasturi","year":"2022"},{"key":"ref10","author":"Sadowski","year":"2007","journal-title":"Simhash: Hash-based similarity detection"},{"key":"ref11","article-title":"Experimental study of fuzzy hashing in malware clustering analysis","author":"Li","year":"2015","journal-title":"in 8th workshop on cyber security experimentation and test (cset 15)"},{"key":"ref12","volume-title":"About false positives in detection engineering","year":"2023"},{"key":"ref13","volume-title":"Usage statistics of php for websites","year":"2023"},{"key":"ref14","volume-title":"Welcome to the world\u2019s most popular website builder","year":"2023"},{"key":"ref15","volume-title":"Symfony, high performance php framework for web development","year":"2023"},{"key":"ref16","volume-title":"php-src","year":"2023"},{"key":"ref17","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1109\/PACT.2001.953283","article-title":"Basic block distribution analysis to find periodic behavior and simulation points in applications","volume-title":"2001 International Conference on Parallel Architectures and Compilation Techniques (PACT 2001)","author":"Sherwood","year":"2001"},{"key":"ref18","volume-title":"Php malware finder","year":"2016"},{"key":"ref19","volume-title":"yara: The pattern matching swiss knife for malware researchers(and everyone else)","year":"2023"},{"key":"ref20","volume-title":"Backdoorman","year":"2016"},{"key":"ref21","volume-title":"php-malware-scanner","year":"2022"},{"key":"ref22","volume-title":"Clamav","year":"2023"},{"key":"ref23","volume-title":"cloudwalker","year":"2023"},{"key":"ref24","volume-title":"Shellsweep","year":"2023"},{"key":"ref25","volume-title":"phpcpd: Copy\/paste detector (cpd) for php code","year":"2022"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/icpc.2008.41"},{"key":"ref27","volume-title":"jscpd: Copy\/paste detector for programming source code","year":"2023"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598040"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2872427.2882992"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102366"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/iwsc.2017.7880507"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/saner50967.2021.00053"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468564"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/tse.2002.1019480"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/icsme.2017.46"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/wcre.2012.48"}],"event":{"name":"2025 IEEE\/ACM International Symposium on Quality of Service (IWQoS)","location":"Gold Coast, Australia","start":{"date-parts":[[2025,7,2]]},"end":{"date-parts":[[2025,7,4]]}},"container-title":["2025 IEEE\/ACM 33rd International Symposium on Quality of Service (IWQoS)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11143240\/11143247\/11143530.pdf?arnumber=11143530","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,10]],"date-time":"2025-09-10T05:04:56Z","timestamp":1757480696000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11143530\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,2]]},"references-count":36,"URL":"https:\/\/doi.org\/10.1109\/iwqos65803.2025.11143530","relation":{},"subject":[],"published":{"date-parts":[[2025,7,2]]}}}