Detecting C&C Server in the APT Attack based on Network Traffic using Machine Learning

APT (Advanced Persistent Threat) attack is a form of dangerous attack, it has clear intentions and targets. APT uses a variety of sophisticated, complex methods and technologies to attack on targets to gain confidential, sensitive information. Currently, the problem of detecting APT attacks still faces many challenges. The reason is APT attacks are designed specifically for each specific target, so it is difficult to detect them based on experiences or predefined rules. There are many different methods that are researched and applied to detect early signs of APT attacks in an organization. Today, one method of great concern is analyzing connections to detect a control server (C&C Server) in the APT attack campaign. This method has great practical significance because we just need to detect early the connection of malware to the control server, we will prevent quickly attack campaigns. In this paper, we propose a method to detect C&C Server based on network traffic analysis using machine learning.

@article{Xuan2020,
  title     = {Detecting C&C Server in the APT Attack based on Network Traffic using Machine Learning},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {11},
  number    = {5},
  year      = {2020},
  publisher = {The Science and Information Organization},
  author    = {Cho Do Xuan and Lai Van Duong and Tisenko Victor Nikolaevich},
  doi       = {10.14569/IJACSA.2020.0110504},
  url       = {https://doi.org/10.14569/IJACSA.2020.0110504}
}