This repository contains PHP source code for evaluating WebShell detection and robustness to code obfuscation. It contains only original and obfuscated .php files.
The repository includes 14,399 base samples and 2,519 Yak Pro-obfuscated samples paired with their original WebShell files, for a total of 16,918 PHP files.
| Directory | Class | Files | Description |
|---|---|---|---|
normal/ |
Benign | 11,730 | Source code from four open-source PHP projects, with the original project directory structures preserved |
webshell/ |
WebShell | 2,669 | Original WebShell files used in the standard benchmark |
webshell_obf/ |
WebShell | 2,519 | Yak Pro-obfuscated variants paired with samples in webshell/ by filename |
The base benchmark contains 11,730 benign samples and 2,669 WebShell samples, for a total of 14,399 source files. The webshell_obf/ directory is intended for evaluating model robustness to code obfuscation.
- File type: PHP source code (
.php) - Character encoding: each file retains its original encoding; no uniform encoding conversion was applied
- Labels: determined by directory
normal/: benignwebshell/: WebShellwebshell_obf/: obfuscated WebShell