<p>Webshell attacks are a common method in network attacks, where attackers gain partial control over the web server through a Webshell to carry out malicious activities. These attacks are often covert, with attackers continually developing new Webshell variants to evade detection. The lack of information sharing among servers leads to inconsistent detection capabilities, hindering effective defense systems. To address these challenges, we propose a Webshell detection method utilizing federated learning, which integrates diverse features from Webshell analysis, including source code, Abstract Syntax Tree sequences, Opcode sequences, and various statistical attributes. Our approach employs a TextCNN-based neural network tailored to learn malicious behaviors exhibited by Webshell samples. By utilizing the FedAvg algorithm and the DP-SGD optimizer, we facilitate collaborative training while maintaining data privacy. Experimental results on the AMWD’22 dataset indicate that our model achieves an accuracy of 99.47% and an F-1 score of 99.67%, outperforming existing models. Additionally, we show an improvement in accuracy from 98.01 to 99.01% through comparative federated learning experiments, all while safeguarding sensitive information. While our method demonstrates potential, it may encounter certain challenges related to the computational overhead of federated learning, adversarial robustness, and scalability, suggesting areas for further exploration.</p>