shelltrap.com
en de

Heuristics engine

How Shelltrap’s built-in heuristics score PHP and script files without signatures: signal groups, weak signals, allowlists and how to tune false positives per domain.

The heuristics engine (shelltrap:heuristics-v1, proprietary, Panomity GmbH) scores files by combining independent signals: request-driven command execution, dynamic eval/assert, encoded payload layers, escape density, entropy and long lines.

  • Weak statistical signals (entropy, long lines) never produce a suspicious verdict on their own; minified bundles and caches stay clean.
  • Documented library files (PHP tag first, a @package/@license docblock in the first 2 KiB, no eval/base64_decode/gzinflate) are held below suspicious even with escape-heavy code.
  • Verified WordPress core files are cleared by the allow sets before heuristics run.
  • Per domain, heuristics.action can be set to report, quarantine or off, and heuristics.threshold raises the bar for suspicious findings.

Report false positives with finding ID and file hash to hallo@panomity.de .