Optimal remote access trojans detection based on network behavior

Abstract

<p>RAT is one of the most infected malware in the hyper-connected world. Data is being leaked or disclosed every day because new remote access Trojans are emerging and they are used to steal confidential data from target hosts. Network behavior-based detection has been used to provide an effective detection model for Remote Access Trojans. However, there is still short comings: to detect as early as possible, some False Negative Rate and accuracy that may vary depending on ratio of normal and malicious RAT sessions. As typical network contains large amount of normal traffic and small amount of malicious traffic, the detection model was built based on the different ratio of normal and malicious sessions in previous works. At that time false negative rate is less than 2%, and it varies depending on different ratio of normal and malicious instances. An unbalanced dataset will bias the prediction model towards the more common class. In this paper, each RAT is run many times in order to capture variant behavior of a Remote Access Trojan in the early stage, and balanced instances of normal applications and Remote Access Trojans are used for detection model. Our approach achieves 99 % accuracy and 0.3% False Negative Rate by Random Forest Algorithm.</p>

Detection of the botnets’ low-rate DDoS attacks based on self-similarity

“…In [16][17] the machine learning-based methods for cyberattacks detection are presented. Network behavior-based detection techniques are presented in [18], where the investigation of a large amount of normal traffic and amount of malicious traffic is provided. In [19,20] the systematic review of aspects of DDoS attacks detection and new frameworks are investigated.…”