PRATD: A Phased Remote Access Trojan Detection Method with Double-Sided Features

Abstract

Remote Access Trojan (RAT) is one of the most terrible security threats that organizations face today. At present, two major RAT detection methods are host-based and network-based detection methods. To complement one another’s strengths, this article proposes a phased RATs detection method by combining double-side features (PRATD). In PRATD, both host-side and network-side features are combined to build detection models, which is conducive to distinguishing the RATs from benign programs because that the RATs not only generate traffic on the network but also leave traces on the host at run time. Besides, PRATD trains two different detection models for the two runtime states of RATs for improving the True Positive Rate (TPR). The experiments on the network and host records collected from five kinds of benign programs and 20 famous RATs show that PRATD can effectively detect RATs, it can achieve a TPR as high as 93.609% with a False Positive Rate (FPR) as low as 0.407% for the known RATs, a TPR 81.928% and FPR 0.185% for the unknown RATs, which suggests it is a competitive candidate for RAT detection.

Analysis of Remote Access Trojan Attack using Android Debug Bridge

“…This research is conducted with the scenario of exploiting the Android device through Android Debug Bridge (ADB). The process of exploiting remote access on the Android system can help us to understand how the third parties doing the attack of remote access Trojan [19]. An exploit is a series of commands, data, or software that exploits the vulnerability of the target computer [20].…”