# An Exploit Traffic Detection Method Based on Reverse Shell
## 4 Evaluation
### Experimental Design Scheme
#### 4.2.4 The Stratification Results of Detected Exploit Traffic  
Experience 4 uses a bisecting K-means algorithm to stratify the detected exploit traffic and visualize the exploit traffic, thus further proving the interpretability of ETDetector. The preset cluster number in the bisecting K-means algorithm is four, and the traffic of the buffer overflow vulnerability CVE-2017-7494 reverse shell at two stages is stratified.  
Figure 9 shows the traffic stratification results in the shellcode delivery phase. In this stage, the attacker aims to deliver the malicious shellcode to the target. The packets bearing on the shellcode are intense at the beginning of the session, and the payload is long and diverse. Meanwhile, the target usually passively receives the shellcode and only delivers the ACK message without a valid payload. Therefore, all clusters are above the axis of X equals 0 in Figure 9, and the value of the Y-axis is diverse.  
Figure 10 shows the traffic stratification results in the shellcode execution phase, and the reverse shell attack is implemented by the python/shell_reverse_tcp_ssl module. In the shellcode execution phase, the target returns the encrypted shell. Initially, the attacker delivers the malicious payload to the target, corresponding to the blue cluster below the axis of X equals 0. in Figure 10. Then, the encryption protocol negotiates, bi-direction packets interact frequently and have symmetrical lengths. This process is very short-lived and corresponds to the purple cluster in Figure 10. After the shell is returned successfully, the attacker usually executes commands to obtain information about the target. In general, the data flows to the attacker. Typically, packets carrying commands are short in length and relatively dispersed; however, the target machine needs to return corresponding execution results according to different commands, so the packets carrying execution results have different lengths, corresponding to the green cluster and yellow cluster on either side of the axis of X equals 0 in Figure 10.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Vulnerability Type, CVE, and Shell Type** & **Encrypted** & **Reference [11]** & **Ours** \\ \hline Remote code execution vulnerability, & & & \\ CVE-2021-22205, bash & \(\chi\) & & \\ \hline Buffer overflow vulnerability, MS17-010, Python & \(\chi\) & & \\ \hline Remote code execution vulnerability, & & & \\ CVE-2020-17530, Perl+OpenSSL & & & \\ \hline Remote code execution vulnerability, & & & \\ CVE-2019-15107, linux/x64/shell/reverse\_tcp & & & \\ \hline Buffer overflow vulnerability, MS17-010, & & & \\ windows/shell\_reverse\_tcp & & & \\ \hline Buffer overflow vulnerability, CVE-2017-7494, & & & \\ python/shell\_reverse\_tcp\_ssl & & & \\ \hline Remote code execution vulnerability, CVE-2019-0708, & & & \\ windows/Meterpreter/reverse\_tcp & & & \\ \hline Buffer overflow vulnerability, CVE-2017-7494, & & & \\ linux/x64/Meterpreter/reverse\_tcp & & & \\ \hline Remote code execution vulnerability, CVE-2019-0708, & & & \\ windows/Meterpreter/reverse\_http & & & \\ \hline Remote code execution vulnerability, CVE-2019-0708, & & & \\ windows/Meterpreter/reverse\_tcp\_rc4 & & & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparison of detection results of exploit traffic.