Webshell script detection method and webshell script detection device

The invention provides a webshell script detection method and a webshell script detection device. According to the method, a plurality of different set types of features are extracted; the diversity of features used for training the SVM model is guaranteed, the extracted features of different set types are screened on the basis of the Fisher scoring algorithm, the SVM model is trained by utilizingthe screened features, and the classification accuracy of the SVM model can be further improved. On the basis, a plurality of different set types of features are extracted from the script to be detected, the extracted plurality of different set types of features are screened by using a Fisher scoring algorithm, and the screened features are input into the SVM model, so that the accuracy of a classification result output by the SVM model can be improved. 本申请提供了一种webshell脚本检测方法及装置，该方法通过对多个不同设定类型的特征的提取，保证对SVM模型进行训练所用特征的多样性，并基于费舍尔评分算法对提取的多个不同设定类型的特征进行筛选，利用筛选后的特征对SVM模型进行训练，可以进一步提高SVM模型分类的准确性。在此基础上，对待检测脚本进行多个不同设定类型的特征的提取，并