# An Exploit Traffic Detection Method Based on Reverse Shell
## 4 Evaluation
### Experimental Setup
#### 4.1.2 Evaluate Metrics  
We evaluate the performance of the decision tree classifier according to _Accuracy_, _Precision_, _Recall_, _F1-score_, and _F2-score_. To illustrate the meaning of the above assessment indexes, we define four cases and five assessment indexes of the binary model as follows. * TP (TRUE positive): The current traffic is predicted to be reverse shell traffic, and it is reverse shell traffic. * FN (FALSE negative): The current traffic is predicted to be normal, but it is a reverse shell traffic. * FP (FALSE positive): The current traffic is predicted to be reverse shell traffic, but it is normal traffic. * TN (TRUE negative): The current traffic is predicted to be normal, and it is normal traffic. \[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{1}\]  
\[Precision=\frac{TP}{TP+FP} \tag{2}\]  
\[Recall=\frac{TP}{TP+FN} \tag{3}\]  
\[F1\text{-}score=\frac{2*Precision*Recall}{Precision+Recall} \tag{4}\]  
\[F2\text{-}score=\frac{5*Precision*Recall}{4*Precision+Recall} \tag{5}\]  
According to Equations (2) and (3), the _Accuracy_ is the proportion of correctly predicted reverse shell traffic in the predicted reverse shell traffic, and the _Recall_ is the proportion of correctly predicted reverse shell traffic in the total reverse shell traffic. The former represents the false positive rate, and the latter relates to the false negative rate. From the view of practice, we aim to detect malicious traffic as much as possible, so the false negative rate and _Recall_ can better reflect the effectiveness of the detection model. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Scene** & **Traffic Type (Number)** & **Use** \\ \hline \multirow{3}{*}{Get online legally} & \multirow{3}{*}{Background traffic (38,512)} & 18\% for training and validation (6847) and 82\% for testing in Experiments 1 and 2 (31,665) \\ \cline{1-1}  & & 72\% for training and validation (6847) and 28\% for testing in Experiments 1 and 2 (21) \\ \hline \multirow{3}{*}{\begin{tabular}{c} Non-encrypted reverse shell \\ \end{tabular} } & Non-encrypted reverse shell traffic (77) & 72\% for training and validation (6847) and 28\% for testing in Experiments 1 and 2 (21) \\ \hline \multirow{3}{*}{\
\begin{tabular}{c} Encrypted reverse shell \\ \end{tabular} } & Encrypted reverse shell traffic (39) & Used for testing in Experiment 2 \\ \hline \multirow{3}{*}{
\begin{tabular}{c} Realistic attack \\ scenario \\ \end{tabular} } & Non-encrypted reverse shell traffic (5); encrypted reverse shell traffic (5) & Used for testing in Experiment 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The detailed description of our dataset. According to Equations (4) and (5), compared with _F1-score_, _F2-score_ increases the weight of the _Recall_ and can better represent the overall detection effect of the model. In addition, we use the detection rate of encrypted traffic, non-encrypted traffic, and all vulnerability exploitation traffic to evaluate the performance of our method. The higher the detection rate, the lower the probability of code execution vulnerability exploitation behavior escaping detection, that is, the better the detection method effect. Within the defined time \(T\), the total number of occurrences of code execution vulnerability exploitation d behavior is \(N\), where the number of occurrences under traffic encryption condition is denoted as _N-crypted_, and the number of occurrences without encryption is denoted as _N-noncrypted_. The number of code execution vulnerability exploitation behaviors detected is \(M\), where the number of encrypted traffic is denoted as _M-crypted_ and the number of non-encrypted traffic is denoted as _M-noncrypted_. * _M_: The number of code execution vulnerability exploitation behaviors detected in the defined time \(T\). * _MC_: The number of encrypted traffic detected in the defined time \(T\). * _MN_: The number of non-encrypted traffic detected in the defined time \(T\). * _N_: The total number of occurrences of code execution vulnerability exploitation behavior in the defined time \(T\).