NDLI: Ctracer: Uncover C&C in Advanced Persistent Threats Based on Scalable Framework for Enterprise Log Data

Content Provider	IEEE Xplore Digital Library
Author	Kai-Fong Hong Chien-Chih Chen Yu-Ting Chiu Kuo-Sen Chou
Copyright Year	2015
Description	Author affiliation: Inf. & Commun. Security Lab., Chunghwa Telecom Labs., Chung-Li, Taiwan (Kai-Fong Hong; Chien-Chih Chen; Yu-Ting Chiu; Kuo-Sen Chou)
Abstract	Advanced Persistent Threat (APT), unlike traditional hacking attempts, carries out specific attacks on a specific target to illegally collect information and data from it. These targeted attacks use special-crafted malware and infrequent activity to avoid detection, so that hackers can retain control over target systems unnoticed for long periods of time. In order to detect these stealthy activities, a large-volume of traffic data generated in a period of time has to be analyzed. We proposed a scalable solution, Ctracer to detect stealthy command and control channel in a large-volume of traffic data. APT uses multiple command and control (C&C) channel and change them frequently to avoid detection, but there are common signatures in those C&C sessions. By identifying common network signature, Ctracer is able to group the C&C sessions. Therefore, we can detect an APT and all the C&C session used in an APT attack. The Ctracer is evaluated in a large enterprise for four months, twenty C&C servers, three APT attacks are reported. After investigated by the enterprise's Security Operations Center (SOC), the forensic report shows that there is specific enterprise targeted APT cases and not ever discovered for over 120 days.
Starting Page	551
Ending Page	558
File Size	367887
Page Count	8
File Format	PDF
e-ISBN	9781467372787
DOI	10.1109/BigDataCongress.2015.86
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-06-27
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Computers Command and control systems Itemsets Advanced Persistent Threat (APT) Malware Mapreduce Internet Electronic mail Command and Control (C&C) Servers Networking logs
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Advanced Persistent Threats - detection and defense

CAS: A framework of online detecting advance malware families for cloud-based security

Scalable command and control detection in log data through UF-ICF analysis

A Comprehensive Survey on Advanced Persistent Threat (APT) Detection Techniques

Concept for a security investigation framework

Trusted Computing vs. Advanced Persistent Threats: Can a Defender Win This Game?

A Study on Advanced Persistent Threats

Framework for design of Graybot in social network

Ctracer: Uncover C&C in Advanced Persistent Threats Based on Scalable Framework for Enterprise Log Data

Similar Documents

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Advanced Persistent Threats - detection and defense

CAS: A framework of online detecting advance malware families for cloud-based security

Scalable command and control detection in log data through UF-ICF analysis

A Comprehensive Survey on Advanced Persistent Threat (APT) Detection Techniques

Concept for a security investigation framework

Trusted Computing vs. Advanced Persistent Threats: Can a Defender Win This Game?

A Study on Advanced Persistent Threats

Framework for design of Graybot in social network

Ctracer: Uncover C&C in Advanced Persistent Threats Based on Scalable Framework for Enterprise Log Data