Detecting stealthy backdoors with association rule mining

Authors:
Stefan Hommes;Radu State;Thomas Engel
Affiliations:
SnT, University of Luxembourg, Luxembourg;SnT, University of Luxembourg, Luxembourg;SnT, University of Luxembourg, Luxembourg
Venue:
IFIP'12 Proceedings of the 11th international IFIP TC 6 conference on Networking - Volume Part II
Year:
2012

Citing 8
Cited 0

Mining association rules between sets of items in large databases

SIGMOD '93 Proceedings of the 1993 ACM SIGMOD international conference on Management of data
Mining association rules with multiple minimum supports

KDD '99 Proceedings of the fifth ACM SIGKDD international conference on Knowledge discovery and data mining
Adaptive, Model-Based Monitoring for Cyber Attack Detection

RAID '00 Proceedings of the Third International Workshop on Recent Advances in Intrusion Detection
Learning Rules for Anomaly Detection of Hostile Network Traffic

ICDM '03 Proceedings of the Third IEEE International Conference on Data Mining
Efficient mining of both positive and negative association rules

ACM Transactions on Information Systems (TOIS)
A Model-Based Frequency Constraint for Mining Associations from Transaction Data

Data Mining and Knowledge Discovery
Rare Association Rule Mining and Knowledge Discovery: Technologies for Infrequent and Critical Event Detection

Rare Association Rule Mining and Knowledge Discovery: Technologies for Infrequent and Critical Event Detection
Finding sporadic rules using apriori-inverse

PAKDD'05 Proceedings of the 9th Pacific-Asia conference on Advances in Knowledge Discovery and Data Mining

Quantified Score

Hi-index	0.00

Visualization

Abstract

In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system. Detecting such activation sequences is extremely challenging because of varying port sequences and easily modifiable port values. Simple signature-based approaches are not appropriate, whilst more advanced statistics-based testing will not work because of missing and incomplete data. We leverage techniques derived from the data mining community designed to detect sequences of rare events. Simply stated, a sequence of rare events is the joint occurrence of several events, each of which is rare. We show that searching for port knocking sequences can be reduced to a problem of finding rare associations. We have implemented a prototype and show some experimental results on its performance and underlying functioning.