PHP Webshell Dataset

First PHP Webshell Opcode Incremental Dataset

CC BY-NC 4.0Introduced 2025-02-26

First PHP Webshell Opcode Incremental Dataset

Motivation

To improve the robustness of PHP webshell detection by analyzing low-level opcode patterns, circumventing common code obfuscation and evasion techniques.

Content Summary

  • ​Samples:
    10,000+ PHP files (5,000+ webshells, some with anti-detection tricks , 5,000+ benign files from WordPress/PHPCMS). Includes source code, opcodes, processed opcodes
  • ​Preprocessing:
    Extracted opcode sequences and decoded ​**Opcode Double-Tuples (ODTs)**​ with expert-designed filtering rules
  • ​Temporal Validation:
    Split into pre-2021 (training/validation) and 2021-2024 (testing) samples. Can be used for incremental learning.

License

CC BY-NC 4.0
*Academic use only.

Key Value

Enables behavior-based detection models by preserving semantic context through opcode-level feature engineering.