# A Packet Content-Oriented Remote Code Execution Attack Payload Detection Model
## 5 Experimental Results and Analysis
### Evaluation of XXE Detection  
In this section, we evaluate the effectiveness of the XXE detector. The evaluation results are shown in Table 6. Out of 100 benign packets, 97 are correctly classified as benign, and 3 are misclassified as malicious (TN = 97, FP = 3). Out of 18 malicious packets, 17 are correctly classified as malicious, and 1 is misclassified as benign (TP = 17, FN = 1). Thus, the precision is 0.85, the recall is 0.94, and the F1 score is 0.89.  
We analyze the misclassified packets and summarize the causes of the misjuddments. The case of the false negative is shown in Figure 11. The attacker uploads the malicious DTD  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**TP** & **TN** & **FP** & **FN** & **Precision** & **Recall** & **F1** \\ (\(\
earrow\)) & (\(\
earrow\)) \\ \hline
17 & 97 & 3 & 1 & 0.85 & 0.94 & 0.89 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Evaluation results of XXE attack detection. The higher (\(\
earrow\)) or lower (\(\searrow\)) the value is, the better the model is.  
Figure 10: ROC curves of ELi and IDSER detection. (**a**) ROC curves of naive Bayes; (**b**) ROC curves of decision tree; (**c**) ROC curves of logistic regression; (**d**) ROC curves of random forest; (**e**) ROC curves of SVM; (**f**) ROC curves of XGBoost.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Model** & **TP** & **TN** & **FP** & **FN** & **Precision** & **Recall** & **F1** \\  & (\(\
earrow\)) & (\(\
earrow\)) \\ \hline Naive Bayes & 92 & 296 & 3 & 71 & 0.97 & 0.56 & 0.71 \\ Decision Tree & **144** & **298** & **1** & **19** & **0.99** & **0.88** & **0.94** \\ Logistic Regression & 136 & **298** & **1** & 27 & **0.99** & 0.83 & 0.91 \\ Random Forest & **144** & **298** & **1** & **19** & **0.99** & **0.88** & **0.94** \\ SVM & 143 & **298** & **1** & 20 & **0.99** & **0.88** & 0.93 \\ XGBoost & 139 & **298** & **1** & 24 & **0.99** & 0.85 & 0.92 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Evaluation results of ELi and IDSER attack detection. The higher (\(\
earrow\)) or lower (\(\searrow\)) the value is, the better the model is. The best scores are shown in **bold**.  
file (i.e., the passwd.dtd file) to the victim server in some other way, and then uses the XXE vulnerability of the victim server to refer to the DTD file. Because the packet carrying the malicious DTD file is not in the current detection period T, the complete UD chain cannot be constructed, which leads to the false negative. The case of the false positive is shown in Figure 12. The attacker uses the payload (1) to attack the victim server (the malicious DTD file constructed by the attacker is saved on 192.168.31.10). Because the attacker enters 2 into w by mistake, the victim server cannot obtain the w.dtd file at 192.168.31.10, so receives response (1). After identifying this error, the attacker corrects it and proceeds with an attack using payload (2). As a result, the victim server successfully retrieves the 2.dtd file. When the XXE detector analyzes these packets, both payload (1) and payload (2) are sent to the victim server within the same period T. Due to the identical entities used by both payloads, payload (1) is incorrectly associated with response (2), leading to a false positive. However, this misclassification does not impact the security practitioners' assessment. Despite payloads without successful attacks being erroneously classified as successful attacks, a complete UD chain can still be constructed from the packets, indicating system compromise during period T.