An Approach to Detect Remote Access Trojan in the Early Stage of Communication

Abstract

As data leakage accidents occur every year, the security of confidential information is becoming increasingly important. Remote Access Trojans (RAT), a kind of spyware, are used to invade the PC of a victim through targeted attacks. After the intrusion, the attacker can monitor and control the victim's PC remotely, to wait for an opportunity to steal the confidential information. Since it is hard to prevent the intrusion of RATs completely, preventing confidential information being leaked back to the attacker is the main issue. Various existing approaches introduce different network behaviors of RAT to construct detection systems. Unfortunately, two challenges remain: one is to detect RAT sessions as early as possible, the other is to remain a high accuracy to detect RAT sessions, while there exist normal applications whose traffic behave similarly to RATs. In this paper, we propose a novel approach to detect RAT sessions in the early stage of communication. To differentiate network behaviors between normal applications and RAT, we extract the features from the traffic of a short period of time at the beginning. Afterward, we use machine learning techniques to train the detection model, then evaluate it by K-Fold crossvalidation. The results show that our approach is able to detect RAT sessions with a high accuracy. In particular, our approach achieves over 96% accuracy together with the FNR of 10% by Random Forest algorithm, which means that our approach is valid to detect RAT sessions in the early stage of communication.1550-445X/15 $31.00

Closed-loop Feedback Trojan Detection Technique Based on Hierarchical Model

“…Transport Layer features, e.g., communications time, "heartbeat" packet to keep-alive, upload and download traffic [6] .…”

Reconstructing C2 Servers for Remote Access Trojans with Symbolic Execution

“…Unfortunately this may not be possible for a variety of reasons. For instance, a company that discovers and promptly contains an infection [14] may not allow communications for the sake of analysis, especially where there is a suspicion of a targeted attack-as such communications would reveal that the target has been reached. A server counterpart may also decline connection attempts when the analysis takes place from an unexpected network origin or time frame.…”

Collaborative Framework for Early Detection of RAT-Bots Attacks

“…The communication between RAT master (client) and its slave (server) is either direct which initiated by RAT client or reverse which started by RAT server. Most RATs are conventionally using reverse connections as network security policies prevent external connections [9]. Nevertheless, RAT bots can cause severe damages to infected machines without being detected [10]- [12].…”