Semantic-Preserving Hybrid Tokenization With Codebert For Robust Webshell Detection In Hypertext Preprocessor Source Code

Abstract

Transformer-based code models can achieve high accuracy in PHP(Hypertext Preprocessor) webshell detection, but high in-distribution scores do not necessarily indicate reliable behavior under difficult benign cases. This study investigates shortcut learning in CodeBERT-based PHP webshell classification and proposes a semantic-preserving hybrid representation that combines PHP structural tokens with explicit security-relevant tokens. After curation and SHA-256 exact deduplication, the corpus consists of 6,430 PHP files, including 3,685 benign files and 2,745 malicious webshell samples. The proposed tokenizer normalizes remote code execution sinks, input sources, obfuscation functions, and file operations into explicit tokens such as SINK_RCE_SYSTEM, INPUT_POST, OBF_BASE64, and FILE_INCLUDE. CodeBERT is fine-tuned under repository-aware and cross-partition robustness settings and evaluated using global metrics, confusion matrices, false-positive rates by benign bucket, and attention-based interpretation. Hybrid Tokens achieved an accuracy of 0.9902 and an F1-score of 0.9886 in repository-aware testing, while maintaining an accuracy of 0.9695 and an F1-score of 0.9629 in cross-partition robustness testing. The results indicate that preserving security semantics reduces reliance on superficial artifacts while retaining behavior-critical cues for distinguishing procedural benign scripts from webshells. These findings reframe PHP webshell detection as a robustness problem rather than a pure accuracy-maximization task, and show that security-aware input representation is a practical lever for reducing shortcut dependence. The study contributes to robust code intelligence, security-oriented representation learning, and more reliable evaluation of machine-learning detectors for cybersecurity.