With the gradual development of traffic encryption and text obfuscation technologies. it is increasingly difficult to prevent complicated and malicious WebShell attack events in production environment using traditional detection methods based on text content and network flow features. especially for adversarial samples. variant samples and 0Day vulnerability samples. https://www.roneverhart.com/Stoneraven-West-Non-Ladder/