# A Packet Content-Oriented Remote Code Execution Attack Payload Detection Model
## 1 Introduction  
RCE (Remote Code Execution) is a generalized type of network attack. Attackers use network packets (hereinafter referred to as packets) as carriers to send malicious payloads elaborately constructed to the victim server, inducing the server to execute malicious code [1]. RCE attacks can have a huge impact on the information system, such as disclosing confidential data and destroying essential facilities. In recent years, more and more new RCE vulnerabilities have been revealed. On 16 November 2020, the XStream team released a risk notice regarding the CVE-2020-26217 (https://\(\times\)stream.github.io/CVE-2020-26217.html (accessed on 7 March 2024)) RCE vulnerability. Unauthorized attackers can send specially crafted XML data to web applications using XStream, bypass XStream's blacklist defense, trigger a malicious deserialization process, and subsequently execute remote code. On 24 November 2021, the Alibaba Cloud security team reported the Apache Log4j2 RCE vulnerability ([[https://logging.apache.org/log4j/2.x/security.html](https://logging.apache.org/log4j/2.x/security.html)]([https://logging.apache.org/log4j/2.x/security.html](https://logging.apache.org/log4j/2.x/security.html)), [[https://help.aliyun.com/noticliest/articleid/1060971232.html](https://help.aliyun.com/noticliest/articleid/1060971232.html)]([https://help.aliyun.com/noticliest/articleid/1060971232.html](https://help.aliyun.com/noticliest/articleid/1060971232.html)) (accessed on 7 March 2024)) to the Apache official team. The vulnerability exists because some methods in Apache Log4j2 have recursive parsing functions, allowing attackers to construct malicious requests and trigger the RCE vulnerability. On 24 March 2022, NSFOCUS CERT detected that Spring Cloud had fixed a SpEL expression injection vulnerability. This vulnerability exists because the parameter spring.cloud.function.routing-expression in the request header is processed as a SpEL expression by the apply method of the RoutingFunction class in the Spring Cloud Function, leading to the expression injection vulnerability. An attacker could exploit this vulnerability to remotely execute arbitrary code ([[http://blog.nsfocus.net/spring-cloud-function-spel](http://blog.nsfocus.net/spring-cloud-function-spel)]([http://blog.nsfocus.net/spring-cloud-function-spel](http://blog.nsfocus.net/spring-cloud-function-spel)) (accessed on 7 March 2024)). Packet content-oriented attack detection has always been a focus of researchers. Generally, it is straightforward to establish filtering rules on security devices such as Web Application Firewalls (WAFs), blocking packets carrying RCE attack payloads through keyword matching [2; 3; 4]. However, it brings challenges to the normal operation of business systems. If the system needs to use or load remote resources due to business requirements, blocking packets with sensitive keywords may make the system services unavailable. Simultaneously, with the upgrade of the attack-defense game, in order to avoid the detection of security devices, attackers distort and confuse the payloads to hide malicious features, which makes it hard for the defense system to detect these attack payloads. Therefore, a key problem is how to effectively detect the maliciousness of the content carried by packets and improve the reliability of the detection results. According to the OWASP ([[https://owasp.org/www-project-top-ten](https://owasp.org/www-project-top-ten)]([https://owasp.org/www-project-top-ten](https://owasp.org/www-project-top-ten)) (accessed on 7 March 2024)) Top 10 report, XXE (XML External Entity; we regard XXE as a special type of RCE because attackers can realize some simple code functions, such as port scanning and file reading, through the XML entities), ELi (Expression Language Injection), and IDSER (Insecure Deserialization) are still three kinds of serious RCE attacks that current web applications face.