Dataset Overview
Definition：Code Execution Detection Rule Dataset (RCE)is provided byChangsha Langhui Information Technology Co., Ltd.High-quality web safety testing datasets built by security labs. Each piece of data is defined as "XML Rules + PCAP Traffic + HTTP Reconstructed Text + Attack Type Labels + Ground TruthThe five-tier framework T1059 (command and script interpreter) and T1203 (using client-end loopholes) mapping, which cover command injections (Command Injection), Java back-sequencing RCE, template injection (SSTI), expression injections, document containing the five main subtypes of RCE, training for code-executing gap detection models and the automatic generation design of WAF rules.
| Dataset Name | Code Execution Detection Rule Dataset (RCE) |
| Total Data Volume | 800-20,000 Records |
| Data Type | Five-member group: XML rule + PCAP flow + HTTP returned text + attack type label + standard answer |
| Data Source | Luang Hui Safety Laboratory + Gap Platform Validation Data (HackerOne/Bugcrowd/CNVD) |
| License Type | Commercial Licensing Complete authorization documents are attached |
| Delivery Cycle | 2-3 Weeks |
| Code Executor Subtype | Command Injection, Java Recalculation RCE, Template Injecting STI (Jinja2/Thymeleaf/Freemarker), Expression Injection (Spell/OGNL), Document Containing RCE |
| ATT&CK Mapping | T1059（Command and Scripting Interpreter）、T1203（Exploitation for Client Execution）、T1190（Exploit Public-Facing Application） |
| Output Format | JSONL / CSV / Excel / PCAP |
| Language | Chinese-English Bilingual |
Core Data Fields
Each data contains six categories of rule identification, XML detection rules, attack payload, HTTP restore text, PCAP traffic, and standard answers, covering the complete closed loop from rule definition to validation evaluation.
| Field Category | Field Count | Typical Fields |
|---|---|---|
| Rule Identifier | 4 | rule_id (rule unique ID), rule_name (rule name), category (code execution subtype), severity (serious level: CC/High/Medium) |
| XML Detection Rules | 3 | rule_xml (ModSecurity/CRS XML rule), description_logic (detection logic), monitoring_patters (regular matching mode list) |
| Attack Payload | 3 | Payload (attack on Payload), Payload_ type (load type), Obfuscation_level (dissemination level: noone/low/media/high) |
| HTTP Reconstructed Text | 3 | http_request (the full text of the HTTP request contains Headers+Body), http_response (the full text of the HTTP response), content_ type (response to Content-Type) |
| PCAP Traffic | 4 | pcap_file (PCAP file name), pcap_size (file size), packet_count (number of data packets), protocol (transport layer protocol) |
| Ground Truth | 4 | is_rce (for code-based attack: True/false), rce_ type (type of attack), extloit_success (for success of use), cve_ref (associated CVE number) |
Data Sample Showcase
The following is a sample structured JSON after de-identification, showing the typical format of SQL injection quintuple detection data.
{
"entry_id": "RCE-2024-002341",
"rule_id": "RCE-CMD-0192",
"rule_name": "Command Injection via Pipe Operator",
"category": "Command Injection",
"severity": "Critical",
"rule_xml": "<rule id=\"932150\" phase=\"2\">\n <operator>detectRCE</operator>\n <action>block</action>\n <pattern>(?:;|\\||`|&)\\s*(?:cat|id|whoami|uname|ls|ping|curl|wget|nc|bash)</pattern>\n <target>ARGS|REQUEST_BODY</target>\n</rule>",
"payload": "127.0.0.1 | cat /etc/passwd",
"payload_type": "Command Injection - File Read via Pipe",
"obfuscation_level": "none",
"http_request": "GET /api/ping.php?host=127.0.0.1%20|%20cat%20/etc/passwd HTTP/1.1\r\nHost: vulnerable-app.com\r\n\r\n",
"http_response": "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nPING 127.0.0.1...\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1...",
"pcap_file": "rce_cmd_pipe_passwd.pcap",
"pcap_size": "14532",
"packet_count": 62,
"technique_id": "T1059.004",
"cve_ref": "N/A",
"answer": {
"is_rce": true,
"rce_type": "Command Injection via Pipe Operator",
"exploit_success": true
}
}AI Application Scenarios
RCE testing model training
Five-track linking data provide complete training for the Depth Learning Model and support the code-execution testing model training for the CNN/LSTM/Transformer structure, covering command injection, inverse sequenceization, and STI five RCE types.
WAF Code Enforcement Rules Generation
800 ~20,000 XML detection rules + Payload matching data, training AI models in auto-design code to perform attack characterization and generate WAF/ModSecureity format testing rules, significantly increasing the coverage of the rules.
Code audit AI security analysis
Based on the attack on Payload and CVE maps, the training code audit of command injection functions (system/popen/exec) and unsafe back-sequencing entry points in AI AIS generated recommendations for repair.
Inverse sequenced loophole detection
A rich Java/PHP/Python inverse sequenced Gadget Chain data, training AI models to identify malicious objects in a binary sequenced stream and support full chain testing of ysosurial.
Sandbox escape detection.
Code implements Payload mutation data for training sandbox escape detection AI, identifying abnormal system calls and file access patterns in the container/sandbox environment.
APT attack chain detection
The cover command infusion increases the permanent horizontal moving complete attack chain, and the AI model is trained to identify APT attack patterns from multistage code execution.
Frequently asked questions
Need customised codes to implement detection data programs?
Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform is dedicated to providing high-quality, compliant web security data assets for AI companies and research institutions. Supports flexible combinations by SQL injection subtype, by database platform, and by detection rule format.
Data sample preview Customisation RCE Program Professional technical support