A Practical Experiment of the HTTP-Based RAT Detection Method in Proxy Server Logs

Detecting RAT (Remote Access Trojan or Remote Administration Tool) used in APT (Advanced Persistent Threat) attacks is a challenging task. Many previous methods to detect RATs on the network require monitoring all network traffic. However, it is difficult to keep all network traffic because the size is too huge. Actually, we would have to detect RAT activity through insufficient information such as proxy server logs. Therefore, we proposed how to detect RAT activity in proxy server logs. Our method uses only the behavior and does not use pattern matching. While the behavior is not defined by character strings or regular expressions, is defined by network traffic patterns such as the sizes of the object returned to the client or the intervals of the logged time. The classification performance in general condition is good. However, the performance in practical condition is not certain. In practical condition, we have to choose arbitrary training data. In this paper, we apply this method to actual proxy server logs in practical condition, and show that this method can detect more than 95 percent of malicious communications with few false positives in APT attacks. This method does not require monitoring all network traffic, uses only standard proxy server logs. Moreover, this method can also detect http based RATs in real time.