# An Exploit Traffic Detection Method Based on Reverse Shell
###### Abstract  
As the most crucial link in the network kill chain, exploiting a vulnerability is viewed as one of the most popular attack vectors to get the control authority of the system, which is dangerous for legal users. Therefore, an effective exploit traffic detection method is urgent. However, current methods are almost based on pattern matching, invalid for encrypted traffic. To address this problem, we propose a reverse shell-based exploit traffic detection method, ETDetector. Our key insight is that the reverse shell attack often coexists with vulnerability exploitation as one of the most popular exploit behaviors. So, we first extract the fusion information feature from original features, such as the packet delay sequence, as input of a decision tree model to identify reverse shell traffic in the shellcode execution stage. Then, we trace suspicious traffic in the shellcode delivery stage by reconstructing the session relationship of the two stages above. Compared with Blatta, using a cyclic neural network to detect early exploit traffic, the detection rate of ETDetector is increased by 50% and valid for encrypted exploit traffic. In addition, we propose a traffic stratification method based on a bisecting K-means algorithm, which can intuitively show the traffic communication behavior and improve the interpretability of ETDetector. exploit; reverse shell; malicious traffic detection; behavior features +
Footnote †: journal: Accepted: 11 June 2023  
are successful. [PERSON] et al. [11] propose Blatta, a method of detecting early exploit traffic using a cyclic neural network. The main idea is to analyze the first 400 bytes of the application layer and identify vulnerability exploitation traffic according to shellcode characteristic bytes. In addition, [PERSON] et al. [12] propose a low-rate attack detection method based on fine-grained network intelligence analysis, which detects attacks through unsupervised learning of application layer information. However, these traffic-based exploit detection technologies are almost based on load characteristic pattern matching, identifying shellcode with specific strings, which can be easily evaded and are invalid for encrypted traffic. To overcome the above problems, we propose a novel exploit traffic detection method, ETDetector. We observe that the reverse shell attack often coexists with vulnerability exploitation and is among the most popular exploits. So, ETDetector starts from the inevitable relationship between the exploit and its result. We first extract the fusion information feature from original features, such as the packet delay sequence, as input of a decision tree model to identify reverse shell traffic in the shellcode execution stage. When the proportion of reverse shell traffic decreases to 1/300, the _F1-score_ and _F2-score_ of the fusion information feature are only lower by about 0.05 than the original features, whereas the average time of model training and detection is shortened by 90%. Then, we trace suspicious traffic in the shellcode delivery stage by reconstructing the session relationship of the two stages above. In ten vulnerability exploitation experiments, our method detects nine of them, and the effect is not affected by the specific types of vulnerabilities and traffic encryption methods. The main contributions are as follows:  
* We develop a reverse shell traffic detection method based on thought time. We extract the fusion information feature from original features, such as the packet delay sequence, as input of a decision tree model to identify reverse shell traffic in the shellcode execution stage. * We propose ETDetector, a novel exploit detection method. Different from the existing methods, we take the reverse shell, one of the most popular exploit behaviors, as the entry point to detect exploits traffic. We first identify reverse shell traffic in the shellcode execution stage. Then, we trace suspicious traffic in the shellcode delivery stage by reconstructing the session relationship of the two stages above.