Detecting Stealthy Backdoors with Association Rule MiningReport as inadecuate




Detecting Stealthy Backdoors with Association Rule Mining - Download this document for free, or read online. Document in PDF available to download.

1 S-nT - Security, Reliability and Trust Interdisciplibary Research Centre

Abstract : In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system. Detecting such activation sequences is extremely challenging because of varying port sequences and easily modifiable port values. Simple signature-based approaches are not appropriate, whilst more advanced statistics-based testing will not work because of missing and incomplete data. We leverage techniques derived from the data mining community designed to detect sequences of rare events. Simply stated, a sequence of rare events is the joint occurrence of several events, each of which is rare. We show that searching for port knocking sequences can be reduced to a problem of finding rare associations. We have implemented a prototype and show some experimental results on its performance and underlying functioning.

Keywords : backdoor association rule mining cd00r





Author: Stefan Hommes - Radu State - Thomas Engel -

Source: https://hal.archives-ouvertes.fr/



DOWNLOAD PDF




Related documents