...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>International journal of digital crime and forensics >A Highly Efficient Remote Access Trojan Detection Method
【24h】

A Highly Efficient Remote Access Trojan Detection Method

机译：一种高效的远程访问木马检测方法

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Nowadays, machine learning is popular in remote access Trojan (RAT) detection which can create patterns for decision-making. However, most research focus on improving the detection rate and reducing the false negative rate, therefore they ignore the result of abnormal samples. In addition, most classifiers select several proprietary applications and RATs as their training set, which makes them difficult to adapt to the real environment. In this article, the authors address the issue of imbalance dataset between normal and RAT samples, and propose a highly efficient method of detecting RATs in real traffic. In the authors method, they generate eight features by combining the size, the inter-arrival and the flag from one packet sequence. Then, they preprocess the imbalance dataset and implement a classifier by XGBoost algorithm. The classifier achieves a false negative rate of less than 0.18%. Moreover, the authors demonstrate that their classifier is capable of detecting unknown RAT.
机译：如今，机器学习在远程访问木马（RAT）检测中流行，可以创建用于决策的模式。然而，大多数研究侧重于提高检测率并降低假负率，因此它们忽略了异常样品的结果。此外，大多数分类器选择了几个专有的应用程序和大鼠作为他们的训练集，这使得它们难以适应真实环境。在本文中，作者在正常和大鼠样品之间解决了不平衡数据集的问题，并提出了一种高效的检测真实流量大鼠的方法。在作者方法中，它们通过组合大小，到达和来自一个数据包序列的尺寸来生成八个特征。然后，它们预处理不平衡数据集并通过XGBoost算法实现分类器。分类器达到假负率小于0.18％。此外，作者表明，其分类器能够检测未知的大鼠。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号