NDLI: An Approach to Detect Remote Access Trojan in the Early Stage of Communication

Content Provider	IEEE Xplore Digital Library
Author	Dan Jiang Omote, K.
Copyright Year	2015
Description	Author affiliation: Sch. of Inf. Sci., Japan Adv. Inst. of Sci. & Technol., Ishikawa, Japan (Dan Jiang; Omote, K.)
Abstract	As data leakage accidents occur every year, the security of confidential information is becoming increasingly important. Remote Access Trojans (RAT), a kind of spyware, are used to invade the PC of a victim through targeted attacks. After the intrusion, the attacker can monitor and control the victim's PC remotely, to wait for an opportunity to steal the confidential information. Since it is hard to prevent the intrusion of RATs completely, preventing confidential information being leaked back to the attacker is the main issue. Various existing approaches introduce different network behaviors of RAT to construct detection systems. Unfortunately, two challenges remain: one is to detect RAT sessions as early as possible, the other is to remain a high accuracy to detect RAT sessions, while there exist normal applications whose traffic behave similarly to RATs. In this paper, we propose a novel approach to detect RAT sessions in the early stage of communication. To differentiate network behaviors between normal applications and RAT, we extract the features from the traffic of a short period of time at the beginning. Afterward, we use machine learning techniques to train the detection model, then evaluate it by K-Fold cross-validation. The results show that our approach is able to detect RAT sessions with a high accuracy. In particular, our approach achieves over 96% accuracy together with the FNR of 10% by Random Forest algorithm, which means that our approach is valid to detect RAT sessions in the early stage of communication.
Starting Page	706
Ending Page	713
File Size	818410
Page Count	8
File Format	PDF
ISSN	1550445X
e-ISBN	9781479979059
DOI	10.1109/AINA.2015.257
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-03-24
Publisher Place	South Korea
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Feature extraction Rats Machine learning algorithms Trojan horses Accuracy Training Support vector machines machine learning targeted attack network behavior Remote Access Trojan detection
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

An Ensemble Approach for Cyber Attack Detection System: A Generic Framework

An approach to detect network attacks applied for network forensics

Malware detection via API calls, topic models and machine learning

An unsupervised feature learning approach to improve automatic incident detection

Trojan Detection Model of Nonlinear SVM Based on an Effective Feature Selection Optimization Algorithm

Machine learning approach for detection of cyber-aggressive comments by peers on social media network

Learning to detect stereo saliency

Machine-learning-based hotspot detection using topological classification and critical feature extraction

Spammer detection on Sina Micro-Blog

An Approach to Detect Remote Access Trojan in the Early Stage of Communication

Similar Documents

An Ensemble Approach for Cyber Attack Detection System: A Generic Framework

An approach to detect network attacks applied for network forensics

Malware detection via API calls, topic models and machine learning

An unsupervised feature learning approach to improve automatic incident detection

Trojan Detection Model of Nonlinear SVM Based on an Effective Feature Selection Optimization Algorithm

Machine learning approach for detection of cyber-aggressive comments by peers on social media network

Learning to detect stereo saliency

Machine-learning-based hotspot detection using topological classification and critical feature extraction

Spammer detection on Sina Micro-Blog

An Approach to Detect Remote Access Trojan in the Early Stage of Communication