# A Packet Content-Oriented Remote Code Execution Attack Payload Detection Model
## 4 Methodology
### ELi and IDSER Detector
#### 4.4.1 Feature Group  
In the current network environment, it is impossible to construct malicious payloads by using sensitive classes/methods without modification. Security systems placed in each network area can effectively discover the attack payloads through their malicious features. So attackers have to make some changes. In order to avoid security systems' detection, attackers need to hide the malicious features of payloads. They usually use the classes and methods provided by the system to splice, replace, and intercept malicious strings to bypass the detection of the security systems. However, normal business systems may also use these classes and methods, so it is not feasible to block them directly by keyword matching.  
Based on the investigation of ELi and IDSER attacks and the research on existing malicious code detection methods [7; 26; 27; 28; 29], we construct a feature group focusing on (1) string operations and (2) the use of sensitive classes/methods to explore the malicious semantic features hidden in the code. The constructed feature group is as Table 1 shows.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**No.** & **Feature Name** & **Description** \\ \hline
1 & no\_charAt & Number of times the charAt method is used \\
2 & no\_getChars & Number of times the getChars method is used \\
3 & no\_toString & Number of times the toString method is used \\
4 & no\_valueOf & Number of times the valueOf method is used \\
5 & no\_subString & Number of times the subString method is used \\
6 & no\_split & Number of times the split method is used \\
7 & no\_concat & Number of times the concat method is used \\
8 & no\_replace & Number of times the replace method is used \\
9 & has\_Runtime & Is the Runtime class used \\
10 & no\_getRuntime & Number of times the getRuntime method is used \\
11 & has\_ProcessBuilder & Is the ProcessBuilder class used \\
12 & no\_forName & Number of times the forName method is used \\
13 & no\_getClass & Number of times the getClass method is used \\
14 & has\_getDeclaredField & Is the getDeclaredField method used \\
15 & has\_newInstance & Is the newInstance method used \\
16 & no\_getMethod & Number of times the getMethod method is used \\
17 & no\_class & Number of times the class field is used \\
18 & has\_getConstructor & Is the getConstructor method used \\
19 & has\_getSystemClassLoader & Is the getSystemClassLoader method used \\
20 & has\_getEngineByName & Is the getEngineByName method used \\
21 & has\_eval & Is the eval method used \\
22 & no\_add & Number of times the “+” operator is used \\
23 & has\_getDeclaredConstructors & Is the getDeclaredConstructors method used \\
24 & has\_getClassLoader & Is the getClassLoader method used \\
25 & has\_start & Is the start method used \\
26 & no\_loadClass & Number of times the loadClass method is used \\
27 & has\_ScriptEngineManager & Is the ScriptEngineManager class used \\
28 & has\_getResource & Is the getResource method used \\
29 & has\_URLClassLoader & Is the URLClassLoader class used \\
30 & no\_decode & Number of times the decode method is used \\
31 & has\_getMethods & Is the getMethods method used \\
32 & has\_exec & Is the exec method used \\
33 & has\_invoke & Is the invoke method used \\
34 & has\_getConstructors & Is the getConstructors method used \\ \hline \hline \end{tabular}
\end{table}
Table 1: Feature group for ELi and IDSER detection.  
Because EL and Java code are different programming languages, we need to use different ways to extract features from them.