Abstract:Advanced persistent threat (APT), with intense penetration, long duration, and high customization, has become one of the most grievous threats to cybersecurity. Furthermore, the design and development of Internet-of-Things (IoT) devices often do not focus on security, leading APT to extend to IoT, such as the Internet of emerging unmanned aerial vehicles (UAVs). Whether malware with attack payload can be successfully implanted into UAVs or not is the key to APT on the Internet of UAVs. APT malware on UAVs establishes communication with the command and control (C&C) server to achieve remote control for UAVs-aware information stealing. Existing effective methods detect malware by analyzing malicious behaviors generated during C&C communication. However, APT malware usually adopts a low-traffic attack mode, a large amount of normal traffic is mixed in each attack step, to avoid virus checking and killing. Therefore, it is difficult for traditional malware detection methods to discover APT malware on UAVs that carry weak abnormal signals. Fortunately, we found that most APT attacks use domain name system (DNS) to locate C&C server of malware for information transmission periodically. This behavior will leave some records in the network flow and DNS logs, which provides us with an opportunity to identify infected internal UAVs and external malicious domain names. This article proposes an APT malware on the Internet of UAVs detection method combining string matching and Fourier transformation based on DNS traffic, which is able to handle encrypted and obfuscated traffic due to packet payloads independence. We preprocessed the collected network traffic by converting DNS timestamps of DNS request to strings and used the trained random forest model to discover APT malware domain names based on features extracted through string-matching-based periodicity detection and Fourier transformation-based periodicity detection. The proposed method has been evaluated on the data set, including part of normal domains from the normal traffic and malicious domains marked by security experts from APT malware traffic. Experimental results have shown that our proposed detection method can achieve the accuracy of 94%, which is better than the periodicity detection algorithm alone. Moreover, the proposed method does not need to set the confidence to filter the periodicity with high confidence.

Detect Malicious Attacks from Entire TCP Communication Process

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Detection of SSL/TLS Protocol Attacks Based on Flow Spectrum Theory

A Communication-Channel-based Method for Detecting Deeply Camouflaged Malicious Traffic

Against Malicious SSL/TLS Encryption: Identify Malicious Traffic Based on Random Forest

Detecting Remote Access Trojans Through External Control at Area Network Borders

Detecting Malicious TLS Network Traffic Based on Communication Channel Features

A General Framework of Trojan Communication Detection Based on Network Traces

APT Traffic Detection Based on Time Transform

Uncovering the Footprints of Malicious Traffic in Wireless/mobile Networks

Identification Domain Fronting Traffic for Revealing Obfuscated C2 Communications

A Method of Run-Time Detecting Ddos Attacks

An anomaly behavior characterization method of network traffic based on Spatial Pyramid Pool (SPP)

A Heuristic Statistical Testing Based Approach for Encrypted Network Traffic Identification.

Encrypted Malicious Traffic Detection Based on Natural Language Processing and Deep Learning

Active and Passive Attack Detection Methods for Malicious Encrypted Traffic

Malware traffic detection based on type II fuzzy recognition

TLS fingerprint for encrypted malicious traffic detection with attributed graph kernel

Malware on Internet of UAVs Detection Combining String Matching and Fourier Transformation.

Detection of LDDoS Attacks Based on TCP Connection Parameters

Discovering Unknown Advanced Persistent Threat Using Shared Features Mined by Neural Networks.