A webshell detection method and device

The embodiment of the invention discloses a webshell detection method and device. The method comprises the following steps of: Obtaining M pieces of sample data, performing analyzing to obtain a DOM tree structure corresponding to each piece of sample data; determining a feature sequence corresponding to each piece of sample data; and performing model training by using the feature sequences of theP black sample data and the feature sequences of the Q white sample data to obtain a binary classification prediction model, predicting the to-be-detected sample data by using the binary classification prediction model, and determining whether the to-be-detected sample data is webshell webpage data or not. According to the embodiment of the invention, the webshell webpage data and the normal webpage data are subjected to model training based on the front-end webpage characteristics; Compared with the prior art of detecting the webshell webpage data based on the background program, the technical problem of inaccurate