PHP Webshell Dataset (First PHP Webshell Opcode Incremental Dataset)

First PHP Webshell Opcode Incremental Dataset

Motivation

To improve the robustness of PHP webshell detection by analyzing low-level opcode patterns, circumventing common code obfuscation and evasion techniques.

Content Summary

• ​Samples:
  10,000+ PHP files (5,000+ webshells, some with anti-detection tricks , 5,000+ benign files from WordPress/PHPCMS). Includes source code, opcodes, processed opcodes
• ​Preprocessing:
  Extracted opcode sequences and decoded ​Opcode Double-Tuples (ODTs)​ with expert-designed filtering rules
• ​Temporal Validation:
  Split into pre-2021 (training/validation) and 2021-2024 (testing) samples. Can be used for incremental learning.

License

[CC BY-NC 4.0]
*Academic use only.

Key Value

Enables behavior-based detection models by preserving semantic context through opcode-level feature engineering.