• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Malicious and Unwanted Software >An In-Depth Study of Open-Source Command and Control Frameworks
【24h】

An In-Depth Study of Open-Source Command and Control Frameworks

机译：深入研究开源命令和控制框架

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Previous work has intensely studied the prevention and detection of malicious network traffic, but current solutions still lack the efficacy needed to detect Remote Access Trojan (RAT) network activity. This deficiency is becoming more of a threat with the releases of open-source implementations that emphasize ease of use while maintaining stealth and modularity. In this paper, we provide a detailed design and analysis of network-based methods that can detect generic RAT behaviors such as polling, and specific detection techniques targeting three popular open-source RATs: Metasploit, Empire, and Pupy. Our methods rely on passive monitoring as well as semi-active scans targeting suspicious servers that are triggered by the passive monitoring system. Our complete classification system achieves a ~98.5% true positive rate and a ~0.01% false positive rate, validating our approach to RAT detection.
机译：先前的工作已经深入研究了恶意网络流量的预防和检测，但是当前的解决方案仍然缺乏检测远程访问特洛伊木马（RAT）网络活动所需的功效。随着开放源代码实现的发布，这种缺陷正变得越来越严重，这些实现强调了易用性，同时又保持了隐身性和模块化。在本文中，我们提供了基于网络的方法的详细设计和分析，这些方法可以检测诸如轮询之类的通用RAT行为，以及针对三种流行的开源RAT（Metasploit，Empire和Pupy）的特定检测技术。我们的方法依赖于被动监视以及针对由被动监视系统触发的可疑服务器的半主动扫描。我们完整的分类系统可达到〜98.5 \％的真实阳性率和〜0.01 \％的假阳性率，从而验证了我们的RAT检测方法。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号