Effective Features for Detection of Remote Access Trojans

Abstract

As companies in every industry sector around the globe have lost, stolen or leaked their sensitive data to the outside world every year, the security of confidential information is increasingly important. Remote Access Trojans (RATs) are used to invade a victim’s PC through targeted attacks. In the previous works features for detection of RATs were selected by the author who may be an expert in the related domain, and any feature selection method was not used. In this paper one of the feature selection methods, Information Gain is applied for evaluating and ranking features. It aims not only to reduce costs and resources for building detection system of remote Access Trojan but also to add the advantages of using feature selection method and propose new features while maintaining high accuracy. Our approach achieves 99% accuracy together with the FNR of 0.091 by Decision Trees algorithm, and this experimental result shows that our proposed features are effective to detection system of RATs.