Abstract:Trojans are one of the most threatening network attacks currently. HTTP-based Trojan, in particular, accounts for a considerable proportion of them. Moreover, as the network environment becomes more complex, HTTP-based Trojan is more concealed than others. At present, many intrusion detection systems (IDSs) are increasingly difficult to effectively detect such Trojan traffic due to the inherent shortcomings of the methods used and the backwardness of training data. Classical anomaly detection and traditional machine learning-based (TML-based) anomaly detection are highly dependent on expert knowledge to extract features artificially, which is difficult to implement in HTTP-based Trojan traffic detection. Deep learning-based (DL-based) anomaly detection has been locally applied to IDSs, but it cannot be transplanted to HTTP-based Trojan traffic detection directly. To solve this problem, in this paper, we propose a neural network detection model (HSTF-Model) based on hierarchical spatiotemporal features of traffic. Meanwhile, we combine deep learning algorithms with expert knowledge through feature encoders and statistical characteristics to improve the self-learning ability of the model. Experiments indicate that F1 of HSTF-Model can reach 99.4% in real traffic. In addition, we present a dataset BTHT consisting of HTTP-based benign and Trojan traffic to facilitate related research in the field.

Detection Method of Trojan Horse Based on Attack Tree

Defense of Hidden Backdoor Technology for Web

Web Page Trojan Detection Method Based on Dynamic Behavior Analysis

An anti-trojans design approach based on activation probability analysis

System and method for detecting Ethereum digital currency stealing attacks

Trojan Detection Using Its Auto-startup Characteristic

Design of Defense Against Trojan Horse System Based on Restricted Token

Prototype demonstration: trojan detection and defense system

Stealthy Trojan Detection Based on Feature Analysis of Circuit Structure

Hardware Trojan detecting method based on circuit characteristic analysis

A Static Method for Detection of Information Theft Malware

Concealing Technology of Trojan Horses and Prevention

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs

A Hardware-Trojans Detection Approach Based on eXtreme Gradient Boosting

Hardware Trojans Classification Based on Controllability and Observability in Gate-Level Netlist.

A method for hidden malcode anomaly detection using dynamic control-flow analysis

A method based on hierarchical spatiotemporal features for trojan traffic detection

An improved kernel Trojan horse architecture model

The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

A Model of APT Attack Defense Based on Cyber Threat Detection

Hardware Trojan Detection Using Effective Property-Checking Method