MVFN-FG: LLM-Driven Deobfuscation and Multi-View Fusion Network for Fine-Grained WebShell Detection
Di Yao1, Yuling Chen1,*, Xiuzhang Yang1,*, Xuewei Wang2, Haiwei Sang3, Weijie Tan1,4, Zhi Ouyang1
1 Guizhou Provincial Laboratory of Big Data, State Key Laboratory of Public Big Data, Guizhou University, Guiyang, China
2 Computer College, Weifang University of Science and Technology, Weifang, China
3 Guizhou Key Laboratory of Artificial Intelligence and Brain-inspired Computing, College of Mathematics and Big Data, Guizhou Education University, Guiyang, China
4 Guizhou Provincial Laboratory of Big Data, College of Computer Science and Technology, Guizhou University, Guiyang, China
* Corresponding Author: Yuling Chen. Email: 
; Xiuzhang Yang. Email: 
Computers, Materials & Continua https://doi.org/10.32604/cmc.2026.086755
Received 04 June 2026; Accepted 26 August 2026; Published online 17 September 2026
Abstract
In recent years, WebShell attacks have exploited web application scripting languages to enable persistent remote control, unauthorized command execution, and flexible post-exploitation operations, making them a widely adopted technique in phishing campaigns, advanced persistent threat (APT) operations, and Internet of Things (IoT) network environments. Existing WebShell detection methods mainly focus on benign–malicious binary classification, while fine-grained malicious behavior analysis remains insufficient. Moreover, heterogeneous scripting languages, code obfuscation, syntactic mutation, and dynamic function invocation further limit the robustness of traditional lexical, syntactic, or structural detection approaches. To address these challenges, we propose MVFN-FG, a novel WebShell detection framework for robust malicious code detection and fine-grained behavior classification. MVFN-FG first employs a large language model to perform semantic-aware deobfuscation and recover the hidden execution logic of obfuscated WebShell scripts. The reconstructed code is then used to construct four complementary feature views, namely WordShell, TokenShell, ASTShell, and FlowShell, which capture lexical patterns, token-level semantics, syntactic structures, and execution-flow dependencies. An adaptive multi-view fusion mechanism is designed to integrate heterogeneous representations, and a hybrid ResNet-BiLSTM-Transformer model is developed to learn hierarchical semantic representations and global behavioral dependencies. Experimental results demonstrate that MVFN-FG improves robustness against complex code mutations and accurately supports both malicious WebShell detection and fine-grained behavior classification. The proposed framework provides effective technical support for WebShell detection and malicious script analysis.
Keywords
WebShell; multi-view fusion; fine-grained behavior classification; ResNet-BiLSTM-Transformer
Open Access
Login
Register
Submit a Paper
Propose a Special lssue
Download PDF
Downloads
Citation Tools
