Available on ORBilu since
06 October 2013
Paper published in a book (Scientific congresses, symposiums and conference proceedings)
Detecting Stealthy Backdoors with Association Rule Mining
Hommes, Stefan; State, Radu; Engel, Thomas
2012In IFIP Networking 2012
Peer reviewed


Full Text
Publisher postprint (178.01 kB)

All documents in ORBilu are protected by a user license.

Send to


Keywords :
backdoor; association rule mining; cd00r
Abstract :
[en] In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system. Detecting such activation sequences is extremely challenging because of varying port sequences and easily modifiable port values. Simple signature-based ap- proaches are not appropriate, whilst more advanced statistics-based test- ing will not work because of missing and incomplete data. We leverage techniques derived from the data mining community designed to detect se- quences of rare events. Simply stated, a sequence of rare events is the joint occurrence of several events, each of which is rare. We show that search- ing for port knocking sequences can be reduced to a problem of finding rare associations. We have implemented a prototype and show some ex- perimental results on its performance and underlying functioning.
Disciplines :
Computer science
Identifiers :
Author, co-author :
Hommes, Stefan ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
State, Radu ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Engel, Thomas ;  University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC)
Language :
Title :
Detecting Stealthy Backdoors with Association Rule Mining
Publication date :
Event name :
Event place :
Prague, Czechia
Event date :
Main work title :
IFIP Networking 2012
Publisher :
Pages :
Peer reviewed :
Peer reviewed
Commentary :
7290 Lecture Notes in Computer Science Lect Notes Comput Sci 1611-3349 0302-9743


Number of views
122 (6 by Unilu)
Number of downloads
2 (0 by Unilu)

Scopus citations®
Scopus citations®
without self-citations


Similar publications

Contact ORBilu