Lindsey Lack

and

John Conwell

Webshell Detection Case Study (pdf, video)