Remote Access Trojans (RATs) have grown dramatically, becoming more complex and difficult to detect. Although there is increased interest in RATs, it remains difficult to deliver accurate and rapid RAT detection. In this paper, we propose RATID, a multi-layer deep learning architecture that can accurately identify different kinds of RATs. This architecture is based on Convolutional Neural Networks, leveraging network flows for the early detection of RATs during their connection establishment phase. We have created a dataset that contains 19,000 sessions of 23 different RAT families. Our comprehensive analysis indicates that the proposed mechanism can achieve high accuracy in both binary and multi-class classification scenarios, surpassing existing state-of-the-art methods. Additionally, it only takes 2 milliseconds to render a decision, thus making it suitable for practical use.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Deep Learning Approach to Early Identification of Remote Access Trojans

  • Giang Tran,
  • Anh Hoang,
  • Tung Bui,
  • Van Tong,
  • Duc Tran

摘要

Remote Access Trojans (RATs) have grown dramatically, becoming more complex and difficult to detect. Although there is increased interest in RATs, it remains difficult to deliver accurate and rapid RAT detection. In this paper, we propose RATID, a multi-layer deep learning architecture that can accurately identify different kinds of RATs. This architecture is based on Convolutional Neural Networks, leveraging network flows for the early detection of RATs during their connection establishment phase. We have created a dataset that contains 19,000 sessions of 23 different RAT families. Our comprehensive analysis indicates that the proposed mechanism can achieve high accuracy in both binary and multi-class classification scenarios, surpassing existing state-of-the-art methods. Additionally, it only takes 2 milliseconds to render a decision, thus making it suitable for practical use.