{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T16:18:03Z","timestamp":1783613883626,"version":"3.55.0"},"reference-count":29,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2024,7,2]],"date-time":"2024-07-02T00:00:00Z","timestamp":1719878400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>In recent years, various Remote Code Execution vulnerabilities on the Internet have been exposed frequently; thus, more and more security researchers have begun to pay attention to the detection of Remote Code Execution attacks. In this paper, we focus on three kinds of common Remote Code Execution attacks: XML External Entity, Expression Language Injection, and Insecure Deserialization. We propose a packet content-oriented Remote Code Execution attack payload detection model. For the XML External Entity attack, we propose an algorithm to construct the use-definition chain of XML entities, and implement detection based on the integrity of the chain and the behavior of the chain\u2019s tail node. For the Expression Language Injection and Insecure Deserialization attack, we extract 34 features to represent the string operation and the use of sensitive classes\/methods in the code, and then train a machine learning model to implement detection. At the same time, we build a dataset to evaluate the effect of the proposed model. The evaluation results show that the model performs well in detecting XML External Entity attacks, achieving a precision of 0.85 and a recall of 0.94. Similarly, the model performs well in detecting Expression Language Injection and Insecure Deserialization attacks, achieving a precision of 0.99 and a recall of 0.88.<\/jats:p>","DOI":"10.3390\/fi16070235","type":"journal-article","created":{"date-parts":[[2024,7,2]],"date-time":"2024-07-02T05:08:34Z","timestamp":1719896914000},"page":"235","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["A Packet Content-Oriented Remote Code Execution Attack Payload Detection Model"],"prefix":"10.3390","volume":"16","author":[{"given":"Enbo","family":"Sun","sequence":"first","affiliation":[{"name":"The 30th Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiaxuan","family":"Han","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu 610207, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yiquan","family":"Li","sequence":"additional","affiliation":[{"name":"The 30th Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu 610207, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,7,2]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Zheng, Y., and Zhang, X. (2013, January 18\u201326). Path sensitive static analysis of web applications for remote code execution vulnerability detection. Proceedings of the 2013 35th International Conference on Software Engineering (ICSE), San Francisco, CA, USA.","DOI":"10.1109\/ICSE.2013.6606611"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Clincy, V., and Shahriar, H. (2018, January 23\u201327). Web application firewall: Network security models and configuration. Proceedings of the 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC), Tokyo, Japan.","DOI":"10.1109\/COMPSAC.2018.00144"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"352","DOI":"10.1049\/iet-ifs.2018.5404","article-title":"Leveraging deep neural networks for anomaly-based web application firewall","volume":"13","author":"Teshnehlab","year":"2019","journal-title":"IET Inf. Secur."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Appelt, D., Nguyen, C.D., and Briand, L. (2015, January 13\u201317). Behind an application firewall, are we safe from SQL injection attacks?. Proceedings of the 2015 IEEE 8th International Conference on Software Testing, Verification and Validation (ICST), Graz, Austria.","DOI":"10.1109\/ICST.2015.7102581"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3073559","article-title":"A survey on malware detection using data mining techniques","volume":"50","author":"Ye","year":"2017","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1016\/j.jpdc.2019.03.010","article-title":"Malicious code detection based on CNNs and multi-objective algorithm","volume":"129","author":"Cui","year":"2019","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"He, X., Xu, L., and Cha, C. (2018, January 4\u20137). Malicious javascript code detection based on hybrid analysis. Proceedings of the 2018 25th Asia-Pacific Software Engineering Conference (APSEC), Nara, Japan.","DOI":"10.1109\/APSEC.2018.00051"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"102501","DOI":"10.1016\/j.cose.2021.102501","article-title":"Obfuscated malware detection using deep generative model based on global\/local features","volume":"112","author":"Kim","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"6724513","DOI":"10.1155\/2020\/6724513","article-title":"Slam: A malware detection method based on sliding local attention mechanism","volume":"2020","author":"Chen","year":"2020","journal-title":"Secur. Commun. Netw."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Fass, A., Krawczyk, R.P., Backes, M., and Stock, B. (2018, January 28\u201329). Jast: Fully syntactic detection of malicious (obfuscated) javascript. Proceedings of the 15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Saclay, France.","DOI":"10.1007\/978-3-319-93411-2_14"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Fan, Y., Hou, S., Zhang, Y., Ye, Y., and Abdulhayoglu, M. (2018, January 19\u201323). Gotcha-sly malware! scorpion a metagraph2vec based malware detection system. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, London, UK.","DOI":"10.1145\/3219819.3219862"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Rusak, G., Al-Dujaili, A., and O\u2019Reilly, U.M. (2018, January 15\u201319). Ast-based deep learning for detecting malicious powershell. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3278496"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Hendler, D., Kels, S., and Rubin, A. (2018, January 29). Detecting malicious powershell commands using deep neural networks. Proceedings of the 2018 on Asia Conference on Computer and Communications Security, Incheon, Republic of Korea.","DOI":"10.1145\/3196494.3196511"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"7087239","DOI":"10.1155\/2018\/7087239","article-title":"A combined static and dynamic analysis approach to detect malicious browser extensions","volume":"2018","author":"Wang","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Liang, H., Yang, Y., Sun, L., and Jiang, L. (2019, January 14\u201319). Jsac: A novel framework to detect malicious javascript via cnns over ast and cfg. Proceedings of the 2019 International Joint Conference on Neural Networks (IJCNN), Budapest, Hungary.","DOI":"10.1109\/IJCNN.2019.8851760"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"101595","DOI":"10.1016\/j.cose.2019.101595","article-title":"ShellBreaker: Automatically detecting PHP-based malicious web shells","volume":"87","author":"Li","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Huang, W., Jia, C., Yu, M., Li, G., Liu, C., and Jiang, J. (2021, January 5\u20138). UTANSA: Static Approach for Multi-Language Malicious Web Scripts Detection. Proceedings of the 2021 IEEE Symposium on Computers and Communications (ISCC), Athens, Greece.","DOI":"10.1109\/ISCC53001.2021.9631400"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"102658","DOI":"10.1016\/j.cose.2022.102658","article-title":"MPSAutodetect: A Malicious PowerShell Script Detection Model Based on a Stacked Denoising Auto-Encoder","volume":"116","author":"Alahmadi","year":"2022","journal-title":"Comput. Secur."},{"key":"ref_19","unstructured":"Wang, J., Xue, Y., Liu, Y., and Tan, T.H. (March, January 14). Jsdc: A hybrid approach for javascript malware detection and classification. Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security, New York, NY, USA."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Kim, K., Kim, I.L., Kim, C.H., Kwon, Y., Zheng, Y., Zhang, X., and Xu, D. (2017, January 3\u20137). J-force: Forced execution on javascript. Proceedings of the 26th International Conference on World Wide Web, Perth, Australia.","DOI":"10.1145\/3038912.3052674"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.jpdc.2017.07.006","article-title":"TT-XSS: A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting","volume":"118","author":"Wang","year":"2018","journal-title":"J. Parallel Distrib. Comput."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Tang, Z., Zhai, J., Pan, M., Aafer, Y., Ma, S., Zhang, X., and Zhao, J. (2018, January 3\u20137). Dual-force: Understanding webview malware via cross-language forced execution. Proceedings of the 33rd ACM\/IEEE International Conference on Automated Software Engineering, Montpellier, France.","DOI":"10.1145\/3238147.3238221"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Li, B., Vadrevu, P., Lee, K.H., Perdisci, R., Liu, J., Rahbarinia, B., Li, K., and Antonakakis, M. (2018, January 18\u201321). JSgraph: Enabling Reconstruction of Web Attacks via Efficient Tracking of Live In-Browser JavaScript Executions. Proceedings of the NDSS, San Diego, CA, USA.","DOI":"10.14722\/ndss.2018.23319"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"8195395","DOI":"10.1155\/2019\/8195395","article-title":"Malware detection based on deep learning of behavior graphs","volume":"2019","author":"Xiao","year":"2019","journal-title":"Math. Probl. Eng."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Ye, Y., Hou, S., Chen, L., Lei, J., Wan, W., Wang, J., Xiong, Q., and Shao, F. (2019, January 10\u201316). Out-of-sample node representation learning for heterogeneous graph in real-time android malware detection. Proceedings of the 28th International Joint Conference on Artificial Intelligence (IJCAI), Macao, China.","DOI":"10.24963\/ijcai.2019\/576"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"16","DOI":"10.1016\/j.istr.2009.03.003","article-title":"Detection of malicious code by applying machine learning classifiers on static features: A state-of-the-art survey","volume":"14","author":"Shabtai","year":"2009","journal-title":"Inf. Secur. Tech. Rep."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"106273","DOI":"10.1016\/j.infsof.2020.106273","article-title":"Detection of malicious software by analyzing the behavioral artifacts using machine learning algorithms","volume":"121","author":"Singh","year":"2020","journal-title":"Inf. Softw. Technol."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Cova, M., Kruegel, C., and Vigna, G. (2010, January 26\u201330). Detection and analysis of drive-by-download attacks and malicious JavaScript code. Proceedings of the 19th International Conference on World Wide Web, Raleigh, NC, USA.","DOI":"10.1145\/1772690.1772720"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"102218","DOI":"10.1016\/j.cose.2021.102218","article-title":"JSContana: Malicious JavaScript detection using adaptable context analysis and key feature extraction","volume":"104","author":"Huang","year":"2021","journal-title":"Comput. Secur."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/16\/7\/235\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T15:08:57Z","timestamp":1760108937000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/16\/7\/235"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,2]]},"references-count":29,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2024,7]]}},"alternative-id":["fi16070235"],"URL":"https:\/\/doi.org\/10.3390\/fi16070235","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7,2]]}}}