Detection of APT Malware through External and Internal Network Traffic Correlation
نویسنده
چکیده
This master thesis presents overview on advanced persistent threat (APT) definition and explanation of it. One of the most dangerous APT named: ”Snake” will be presented along with other similar APT’s. Various virtual environments like e.g. VirtualBox will be investigated in order to understand how APT malware behaves in these environments. The central focus of this master thesis lies on detection of futuristic APT malware based on cross-referencing communication patterns in order to detect APT malware. A prototype detection tool will be created and tested in order to detect similar APT’s like Snake. Additionally a prototype malware will be supplied as well, which contain similar stealth communication techniques as the Snake APT malware. This prototype malware will be tested with the current state of commercial firewall applications in order to prove its effectiveness. In the end challenges and solutions will be presented for future research work.
منابع مشابه
Unsupervised Detection of APT C&C Channels using Web Request Graphs
HTTP is the main protocol used by attackers to establish a command and control (C&C) channel to infected hosts in a network. Identifying such C&C channels in network traffic is however a challenge because of the large volume and complex structure of benign HTTP requests emerging from regular user browsing activities. A common approach to C&C channel detection has been to use supervised learning...
متن کاملEnhancing Network Intrusion Detection through Host Clustering
The state-of-the-art in intrusion detection mainly relies on signature-based techniques. Although signature-based detection is an efficient way of protecting against known threats, it will not protect against new, advanced intrusions such as Advanced Persistent Threats (APTs). Moreover, many intrusion detection systems only monitor the network traffic crossing the external border of a network, ...
متن کاملDetection and Prevention of New and Unknown Malware using Honeypots
Security has become ubiquitous in every domain today as newly emerging malware pose an everincreasing perilous threat to systems. Consequently, honeypots are fast emerging as an indispensible forensic tool for the analysis of malicious network traffic. Honeypots can be considered to be traps for hackers and intruders and are generally deployed complimentary to Intrusion Detection Systems (IDS) ...
متن کاملMalware Detection from a Virtual Machine Correlating Unusual Keystrokes, Network Traffic, and Suspicious Registry Access
Current anti-virus malware detection methods focus on signature-based methods. Recent research has introduced new, effective methods of malware detection. First, recent research including cloud-based monitoring and analysis, joint network-host based methods, feature ranking, machine learning and kernel data structure invariant monitoring are reviewed. Second, virtual machine based malware detec...
متن کاملBayesian-Boolean Logic Security Assessment Model for Malware-Free Intrusions
Attackers have come to leverage exploits precipitated by system vulnerabilities and lapses by using malware which otherwise tends to be noisy as it generates unusual network traffic and system calls. Such noise is usually captured by intrusion detection systems. Therefore, malware-free intrusions which generate little noise if any at all, are especially attractive to APT actors because they cov...
متن کامل