@Article{cmc.2026.086755,
AUTHOR = {Di Yao, Yuling Chen, Xiuzhang Yang, Xuewei Wang, Haiwei Sang, Weijie Tan, Zhi Ouyang},
TITLE = {MVFN-FG: LLM-Driven Deobfuscation and Multi-View Fusion Network for Fine-Grained WebShell Detection},
JOURNAL = {Computers, Materials \& Continua},
VOLUME = {},
YEAR = {},
NUMBER = {},
PAGES = {{pages}},
URL = {http://www.techscience.com/cmc/online/detail/28330},
ISSN = {1546-2226},
ABSTRACT = {In recent years, WebShell attacks have exploited web application scripting languages to enable persistent remote control, unauthorized command execution, and flexible post-exploitation operations, making them a widely adopted technique in phishing campaigns, advanced persistent threat (APT) operations, and Internet of Things (IoT) network environments. Existing WebShell detection methods mainly focus on benign–malicious binary classification, while fine-grained malicious behavior analysis remains insufficient. Moreover, heterogeneous scripting languages, code obfuscation, syntactic mutation, and dynamic function invocation further limit the robustness of traditional lexical, syntactic, or structural detection approaches. To address these challenges, we propose MVFN-FG, a novel WebShell detection framework for robust malicious code detection and fine-grained behavior classification. MVFN-FG first employs a large language model to perform semantic-aware deobfuscation and recover the hidden execution logic of obfuscated WebShell scripts. The reconstructed code is then used to construct four complementary feature views, namely WordShell, TokenShell, ASTShell, and FlowShell, which capture lexical patterns, token-level semantics, syntactic structures, and execution-flow dependencies. An adaptive multi-view fusion mechanism is designed to integrate heterogeneous representations, and a hybrid ResNet-BiLSTM-Transformer model is developed to learn hierarchical semantic representations and global behavioral dependencies. Experimental results demonstrate that MVFN-FG improves robustness against complex code mutations and accurately supports both malicious WebShell detection and fine-grained behavior classification. The proposed framework provides effective technical support for WebShell detection and malicious script analysis.},
DOI = {10.32604/cmc.2026.086755}
}