# An Exploit Traffic Detection Method Based on Reverse Shell
## 3 Methodology
### Traffic Feature Analysis
#### 3.1.1 Original Session Features  
According to the reverse shell behavior model described in Section 2.2.2, reverse shell connections are always initiated by the controlled terminal. Moreover, in the command control stage, the attacker mainly sends the command and the target returns the information, and its behavior has visible interaction. We only choose valid packets in sessions to avoid interference from TCP heartbeat packets. Relevant definitions are as follows.  
**Definition 1**.: _Valid packet is the first SYN packet of a TCP three-way handshake in a session or other packet carrying a payload of more than 1 byte._  
We use three original session features to compare with our method, including packet delay sequence, packet direction sequence, and packet length sequence, which are available according to the quintuple, time stamp, and transmission layer load length of valid packets. The details are as follows:  
Figure 1: The network communication process of a typical TCP-based reverse shell.  
1. Packet delay sequence. The delay of a packet in a session means the time interval between the current packet and the last valid packet. The time interval sequence is the packet delay sequence. When reverse shell attacks occur, the attacker needs to take some time to think about what to do before performing operations, which causes the packet containing the attack command to have a relatively long interval with the next packet. Generally speaking, normal traffic will not appear in this situation. Therefore, this feature can obviously reflect the attacker's thinking time, and we can regard it as a crucial signal for detecting reverse shell attack behavior;
2. Packet direction sequence. We pronounce the sequence of valid packets transmitted in a session as the sequence of packet directions. The direction of the first SYN packet in the three-way handshake is \"0\". The reverse packet direction is marked as \"1\". In addition to packet delay, packet interaction direction sequence is another important feature that can reflect the interaction of reverse shell attack behavior. Generally speaking, in the early stage of rebound shell attacks, the target initiates a TCP connection and returns shell-related information to prepare for subsequent interactions. After a successful reverse shell, the attacker sends the command, the target executes the command, and returns the result. Then, it enters the shell return stage. Taking the Metasploit reverse shell module as an example, the attacker usually sends packets bearing the Trojan to the target machine. When Meterpreter completely takes over the control of the target machine, the target sends the packet carrying the Meterpreter shell information to the control terminal, and the packet transmission direction is \"0\". The last stage is command interaction. The control terminal sends packets carrying attack commands, the direction of which is \"1\". The target machine sends packets with the response message, the direction of which is \"0\". Because the attacker usually waits for the target machine to return the message before executing a new command, there are generally only packets in the direction of \"0\" between the two packets in the direction of \"1\";
3. Packet length sequence. We regard a valid packet length sequence in a session as a packet length sequence. Packet length means transport layer payload length. After returning the shell, the attacker sends the command, and the target machine returns the command execution result. Generally, the length of a system command is within a confined range, but the command execution result is not limited. Usually, one of the primary purposes for the attacker to execute commands after the successful reverse shell attack is to obtain information about the target. Therefore, from the perspective of data flow direction, there is data leakage. This behavior is reflected in the traffic by the shorter payload length of the packet carrying the command and the longer payload length of the packet carrying the response message.