16.5 示例:识别WebShell