{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T16:10:23Z","timestamp":1778256623609,"version":"3.51.4"},"reference-count":29,"publisher":"SAGE Publications","issue":"3","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IFS"],"published-print":{"date-parts":[[2022,2,2]]},"abstract":"<jats:p>Python is a concise language which can be used to build lightweight tools or dynamic object-orientated applications. The various attributes of Python have made it attractive to numerous malware authors. Attackers often embed malicious shell commands into Python scripts for illegal operations. However, traditional static analysis methods are not feasible to detect this kind of attack because they focus on common features and failure in finding those malicious commands. On the other hand, dynamic analysis is not optimal in this case for its time-consuming and inefficient. In this paper, we propose PyComm, a model for detecting malicious commands in Python scripts with multidimensional features based on machine learning, which considers both 12 statistical features and string sequences of Python source code. Meanwhile, three comparison experiments are designed to evaluate the validity of proposed method. Experimental results show that presented model has achieved an excellent performance based on those practical features and random forest (RF) algorithm, obtained an accuracy of 0.955 with a recall of 0.943.<\/jats:p>","DOI":"10.3233\/jifs-211557","type":"journal-article","created":{"date-parts":[[2021,11,9]],"date-time":"2021-11-09T12:56:39Z","timestamp":1636462599000},"page":"2261-2273","source":"Crossref","is-referenced-by-count":5,"title":["PyComm: Malicious commands detection model for python scripts"],"prefix":"10.1177","volume":"42","author":[{"given":"Anmin","family":"Zhou","sequence":"first","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tianyi","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dunhan","family":"Li","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chuangchuang","family":"Song","sequence":"additional","affiliation":[{"name":"China Information Technology Security Evaluation Center, BeiJing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","reference":[{"key":"10.3233\/JIFS-211557_ref1","unstructured":"Behrens S. and Hagen B. , Web shell detection using neopi, 2017."},{"issue":"1","key":"10.3233\/JIFS-211557_ref2","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1023\/A:1010933404324","article-title":"Random forests","volume":"45","author":"Breiman","year":"2001","journal-title":"Machine Learning"},{"key":"10.3233\/JIFS-211557_ref4","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1613\/jair.953","article-title":"Smote: synthetic minority oversampling technique","volume":"16","author":"Chawla","year":"2002","journal-title":"Journal of Artificial Intelligence Research"},{"key":"10.3233\/JIFS-211557_ref5","doi-asserted-by":"crossref","unstructured":"Choi J. , Kim H. , Choi C. and Kim P. , Efficient malicious code detection using n-gram analysis and svm, In 2011 14th International Conference on Network-Based Information Systems, (2011), pp. 618\u2013621. IEEE.","DOI":"10.1109\/NBiS.2011.104"},{"issue":"4","key":"10.3233\/JIFS-211557_ref7","doi-asserted-by":"crossref","first-page":"410","DOI":"10.1002\/sec.168","article-title":"Adaptive naive bayes method for masquerade detection","volume":"4","author":"Dash","year":"2011","journal-title":"Security and Communication Networks"},{"key":"10.3233\/JIFS-211557_ref8","doi-asserted-by":"crossref","first-page":"233","DOI":"10.1145\/1143844.1143874","article-title":"The relationship between precision-recall and roc curves","author":"Davis","year":"2006","journal-title":"Proceedings of the 23rd international conference on Machine learning"},{"key":"10.3233\/JIFS-211557_ref9","doi-asserted-by":"crossref","unstructured":"DietterichThomas G., Ensemble methods in machine learning. In International workshop on multiple classifier systems, (2000), pp. 1\u201315. Springer.","DOI":"10.1007\/3-540-45014-9_1"},{"key":"10.3233\/JIFS-211557_ref10","doi-asserted-by":"crossref","unstructured":"Dumont P. , Meier R. , Gugelmann D. and Lenders V. , Detection of malicious remote shell sessions. In 2019 11th International Conference on Cyber Conflict (CyCon), volume 900 (2019), pp. 1\u201320. IEEE.","DOI":"10.23919\/CYCON.2019.8757163"},{"key":"10.3233\/JIFS-211557_ref11","doi-asserted-by":"crossref","first-page":"101764","DOI":"10.1016\/j.cose.2020.101764","article-title":"Detecting malicious javascript code based on semantic analysis","volume":"93","author":"Fang","year":"2020","journal-title":"Computers & Security"},{"key":"10.3233\/JIFS-211557_ref12","doi-asserted-by":"crossref","first-page":"257","DOI":"10.1145\/3359789.3359813","article-title":"Jstap: A static pre-filter for malicious javascript detection","author":"Fass","year":"2019","journal-title":"Proceedings of the 35th Annual Computer Security Applications Conference"},{"issue":"2","key":"10.3233\/JIFS-211557_ref13","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1007\/s11416-010-0143-3","article-title":"An n-gram and stf-idf model for masquerade detection in a unix environment","volume":"7","author":"Geng","year":"2011","journal-title":"Journal in Computer Virology"},{"key":"10.3233\/JIFS-211557_ref14","first-page":"1","article-title":"Detecting obfuscated javascript malware using sequences of internal function calls","author":"Gorji","year":"2014","journal-title":"Proceedings of the 2014 ACM Southeast Regional Conference"},{"key":"10.3233\/JIFS-211557_ref15","doi-asserted-by":"crossref","first-page":"187","DOI":"10.1145\/3196494.3196511","article-title":"Detecting malicious powershell commands using deep neural networks","author":"Hendler","year":"2018","journal-title":"Proceedings of the 2018 on Asia Conference on Computer and Communications Security"},{"key":"10.3233\/JIFS-211557_ref16","doi-asserted-by":"crossref","unstructured":"Ho T.K. , Random decision forests. In Proceedings of 3rd international conference on document analysis and recognition, volume 1, (1995), pp. 278\u2013282. IEEE.","DOI":"10.1109\/ICDAR.1995.598994"},{"key":"10.3233\/JIFS-211557_ref17","doi-asserted-by":"crossref","unstructured":"Hu X. , Cheng Y. , Duan Y. , Henderson A. and Yin H. , Jsforce: A forced execution engine for malicious javascript detection. In International conference on security and privacy in communication systems, (2017), pp. 704\u2013720. Springer.","DOI":"10.1007\/978-3-319-78813-5_37"},{"issue":"3","key":"10.3233\/JIFS-211557_ref18","doi-asserted-by":"crossref","first-page":"299","DOI":"10.1109\/TKDE.2005.50","article-title":"Using auc and accuracy in evaluating learning algorithms","volume":"17","author":"Huang","year":"2005","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"issue":"4","key":"10.3233\/JIFS-211557_ref19","doi-asserted-by":"crossref","first-page":"311","DOI":"10.1016\/j.cose.2006.11.008","article-title":"Masquerade detection by boosting decision stumps using unix commands","volume":"26","author":"Jian","year":"2007","journal-title":"Computers & Security"},{"key":"10.3233\/JIFS-211557_ref21","unstructured":"Jones K.S. , A statistical interpretation of term specificity and its application in retrieval, Journal of Documentation, 1972."},{"key":"10.3233\/JIFS-211557_ref22","doi-asserted-by":"crossref","unstructured":"Le V-G. , Nguyen H-T. , Pham D-P. , Phung V-O. and Nguyen N-H. , Guruws: a hybrid platform for detecting malicious web shells and web application vulnerabilities. In Transactions on Computational Collective Intelligence XXXII (2019), pp. 184\u2013208. Springer.","DOI":"10.1007\/978-3-662-58611-2_5"},{"key":"10.3233\/JIFS-211557_ref24","first-page":"514","article-title":"Toward a deep learning approach for detecting php webshell","author":"Nguyen","year":"2019","journal-title":"Proceedings of the Tenth International Sympo sium on Information and Communication Technology"},{"issue":"1","key":"10.3233\/JIFS-211557_ref25","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1007\/BF00116251","article-title":"Induction of decision trees","volume":"1","author":"Ross Quinlan","year":"1986","journal-title":"Machine Learning"},{"issue":"3","key":"10.3233\/JIFS-211557_ref26","doi-asserted-by":"crossref","first-page":"231","DOI":"10.1007\/s11416-006-0027-8","article-title":"N-gram analysis for computer virus detection","volume":"2","author":"Sandeep Reddy","year":"2006","journal-title":"Journal in Computer Virology"},{"key":"10.3233\/JIFS-211557_ref27","unstructured":"Rubin A. , Kels S. and Hendler D. , Amsi-based detection of malicious powershell code using contextual embeddings. arXiv preprint arXiv:1905.09538, 2019."},{"key":"10.3233\/JIFS-211557_ref28","first-page":"58","article-title":"Computer intrusion: Detecting masquerades","author":"Schonlau","year":"2001","journal-title":"Statistical Science"},{"issue":"1","key":"10.3233\/JIFS-211557_ref29","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1145\/584091.584093","article-title":"A mathematical theory of communication","volume":"5","author":"Shannon","year":"2001","journal-title":"ACM SIGMOBILE Mobile Computing and Communications Review"},{"key":"10.3233\/JIFS-211557_ref30","doi-asserted-by":"crossref","first-page":"1021","DOI":"10.1145\/2872427.2882992","article-title":"No honor among thieves: A large-scale analysis of malicious web shells","author":"Starov","year":"2016","journal-title":"Proceedings of the 25th International Conference on World Wide Web"},{"issue":"1-3","key":"10.3233\/JIFS-211557_ref32","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1016\/0169-7439(87)80084-9","article-title":"Principal component analysis","volume":"2","author":"Wold","year":"1987","journal-title":"Chemometrics and Intelligent Laboratory Systems"},{"key":"10.3233\/JIFS-211557_ref33","doi-asserted-by":"crossref","first-page":"75268","DOI":"10.1109\/ACCESS.2018.2882517","article-title":"Webshell traffic detection with character-level features based on deep learning","volume":"6","author":"Zhang","year":"2018","journal-title":"IEEE Access"},{"key":"10.3233\/JIFS-211557_ref34","doi-asserted-by":"crossref","unstructured":"Zhang Z. , Li M. , Zhu L. and Li X. , Smartdetect: a smart detection scheme for malicious web shell codes via ensemble learning. In International Conference on Smart Computing and Communication, (2018), pp. 196\u2013205. Springer.","DOI":"10.1007\/978-3-030-05755-8_20"}],"container-title":["Journal of Intelligent &amp; Fuzzy Systems"],"original-title":[],"link":[{"URL":"https:\/\/content.iospress.com\/download?id=10.3233\/JIFS-211557","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T09:44:32Z","timestamp":1777455872000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/full\/10.3233\/JIFS-211557"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,2]]},"references-count":29,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.3233\/jifs-211557","relation":{},"ISSN":["1064-1246","1875-8967"],"issn-type":[{"value":"1064-1246","type":"print"},{"value":"1875-8967","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,2]]}}}