Label propagation in big data to detect remote access Trojans
Sai C. Pallaprolu, Josephine Namayanja, Vandana Pursnani Janeja, C. T. Sai Adithya · 2016
Remote Access Trojans (RATs) provide cyber criminals with unlimited access to infected endpoints. Using the victim's access privileges, they can access and steal sensitive business and personal data including intellectual property and, personally identifiable information. However due to attack evolution, targeted attacks utilize modified versions of known signatures, which means that IDS rules that only match the known signature can be bypassed. In this paper, we propose a semi supervised approach that uses ensemble based label propagation to discover infected RAT packets in large unlabeled data. Our approach is trained on a small sample of labeled instances that usually characterize massive network datasets. Our approach is implemented using Apache Spark where we are able to demonstrate the effective discovery of such Trojans in massive amounts of data. We compare our approach to traditional signature based intrusion detection systems and clearly show that our approach is promising in the domain of cyber security in predicting large sets of unlabeled data using few labeled samples.