RU2769651C2 - Method for forming a signature for detecting unauthorised access to a computer obtained using remote administration means, and system implementing the method - Google Patents

Abstract

FIELD: computing technology.SUBSTANCE: present invention relates to the field of computing technology for detecting instances of network fraud. The technical result is achieved due to a method for forming a signature for detecting unauthorised access to a computer obtained using remote administration means, based on analysing the historical data of keyboard input events when interacting with RAT tools for detecting unique sequences of input events characteristic of RAT tools.EFFECT: increase in the efficiency of detecting network fraud.16 cl, 6 dwg

Description

Technical field

The present invention relates to solutions for detecting cases of fraud in the provision of online financial services, and more specifically to the formation of a signature for detecting unauthorized access to a computer obtained using remote administration tools.

State of the art

In daily life, millions of people use various electronic devices such as desktops, laptops, tablets and smartphones to perform various activities. Such activities may include, for example, browsing the Internet, sending and receiving e-mail, taking photos and videos, participating in a video conference or chat, playing games, etc. Some actions may be privileged or may require user authentication to ensure that only the authorized user participates in them. For example, access to an email account requires the user to enter a username and password.

In addition, every year the field of online financial services, such as banking services or online trading, is becoming more and more popular among users. At the moment, the user of such services has already received such opportunities as: online interaction with banks, various methods of payment and money transfer. At the same time, the number of opportunities and the number of similar services are constantly improving and growing. The variety of payment systems, plastic cards and banking services (bank services are often called remote banking services) allows the user to perform a variety of transactions. For example, one of the new features is the interbank transfer of funds using a phone number. In addition, new contactless payment technologies, online banking and mobile banking make it possible to carry out money transactions without a plastic card or bank account details.

All these possibilities of using electronic devices also attract all sorts of scammers. Therefore, in order to protect against various fraud by third parties, it is necessary to protect both the electronic devices themselves and the software that provides access to privileged services, such as financial services.

There are various mechanisms for protecting the user's electronic devices from access by third parties. So, for example, a PIN code is used for plastic cards. It must be entered when paying for the purchase at the terminal or when performing card transactions using an ATM. If the card is lost, a third party will not be able to use it, as it does not know the PIN code of the card. When a user communicates with a bank call center operator, a secret question or a secret word is usually used to identify the user. When a user works with online banking, a method such as double authentication is often used. After entering the login and password (which could become available to third parties) in the browser on the bank's website, the bank service sends a message to the user's mobile phone containing, for example, an additional verification code that must be entered in a special field to confirm the legitimacy of the entry.

However, it should be noted that existing protection methods do not fully ensure the security of user devices from intruders. There are many complex attacks that are carried out by attackers in order to gain access to the user's funds. Such attacks typically exploit vulnerabilities in user interactions with banking services and merchant sites where online payments are made. Often such attacks are called fraudulent attacks. For example, one way to commit fraud is to gain unauthorized access to a user's computer device using a type of malware such as the Remote Administration Trojan, which allows you to take control of the computer, while hiding behind a completely legal actions. They need to be actively dealt with because, in addition to being very dangerous, they are quite common.

Typical effective solutions for detecting this kind of malware, such as "Remote Access Trojan" are such solutions as recognition of devices by digital fingerprints (English fingerprint), proxy server detection, open network port scanning, IP address geolocation and anomaly detection in network activity.

An example of such solutions is presented in the publication of patent application US 20150324802, which describes the technology for authenticating user transactions. Authentication uses fingerprints of browsers, as well as vectors of various combinations of parameters (device characteristics, geolocation, information about the transaction itself or input patterns).

Another example is the technology described in the patent application RU 2019138365, which consists in identifying potentially dangerous devices with which the user interacts with banking services using open ports.

At the same time, they are not effective when it comes to countering the attacks of fraudsters who have gained access to the Remote Administration Tool (RAT) and the subsequent performance of various operations, including financial ones, on behalf of the user (owner) directly from the user's computer. In this case, fraud prevention is difficult (impossible), since fraudulent activity is performed directly from the computer of the user himself and using software disguised as the user himself.

Therefore, to prevent this kind of fraud, it is necessary to be able to detect and evaluate activities that occur using remote administration tools. At the same time, during the activity assessment, determine the fact that work is being done with the remote service directly from the computer where the remote administration tool is installed, or using remote access. In particular, it is necessary to provide the ability to detect remote administration tools (RAT tools) using signatures (patterns), which in turn allow detection of sequences of keyboard input events. In particular, it is necessary to provide the ability to generate these signatures for use in detecting unauthorized access to a computer obtained using remote administration tools.

Disclosure of invention

The invention relates to solutions for detecting fraud in the provision of online financial services.

The present invention has solved several technical problems. These tasks were:

• the need to detect and prevent fraudulent activities performed using remote administration tools used to interact with remote services;

• the need to detect remote administration of the remote administration tool on the user's (victim's) computer, which indicates illegal access to the user's computer device and remote services;

• the need to create a signature to detect remote administration of the Remote Administration Tool on the user's (victim's) computer.

Each of these tasks was solved within the framework of the claimed invention, while the set of technical solutions presented in the description of the present invention can be implemented both separately from each other and together.

The present invention makes it possible to detect activity performed remotely through remote administration by analyzing the stream of keyboard input events and detecting unique sequences of keyboard input events that are specific to remote administration tools (hereinafter referred to as RAT tools) and at the same time not specific to keyboard input events that occur when physical input by the user on the local keyboard. In this case, the keyboard can be both physical and virtual. This approach allows you to determine the remote control of the RAT tool on the user's computer device and further detect ongoing fraudulent activities. Any modern digital computing device can serve as a user's computer device. Examples of such devices are personal computers, laptops and mobile devices such as tablets and smartphones.

Detection of the specified sequences of keyboard input events is carried out using the generated signatures. The signature allows you to determine the activity that is carried out remotely on an electronic device using a remote administration tool during interaction with remote services, for example, sessions with an online banking service are performed.

Each signature (sample) describes a sequence of keyboard input events (pressing and releasing keyboard keys) with a timing condition and a start indicator for the keyboard input signature to calculate the specified timing condition. In this case, the time condition characterizes the delays between the events of pressing and releasing the keys.

The first technical result of the present invention is to improve the efficiency of online fraud detection.

The second technical result of the present invention is to expand the arsenal of technical means for generating signatures that make it possible to detect remote administration tools.

In one embodiment of the invention, solutions are provided that allow detection and prevention of fraudulent incidents committed using remote administration tools, based on the analysis of keyboard input events, the detection of unique sequences of input events that are specific to remote administration tools, and the identification of suspicious user behavior that may indicate fraudulent activity on behalf of the user when interacting with a remote service, such as a banking service.

Yet another implementation provides solutions to generate a signature for detecting unauthorized access to a computer obtained using remote administration tools, based on the analysis of historical data of keyboard input events when interacting with RAT tools to detect unique sequences of input events that are specific to RAT tools.

Another implementation option offers solutions for detecting activity indicating remote control on a user's computer by the remote administration tool (hereinafter referred to as the RAT tools), based on the analysis of keyboard input events and the detection of unique sequences of input events specific to the RAT tools.

As one embodiment, the present invention proposes a method for generating a signature for detecting remote control of a remote administration tool (hereinafter referred to as the RAT tool), which includes the steps of obtaining a set of session data, including sessions during which the RAT tools were remotely controlled; analyze the received data in order to identify characteristic features that indicate remote control of the RAT tool; searching for sequences of key events that will distinguish sessions using RAT instruments that are controlled remotely from other sessions; evaluating sequences of key events based on the difference between the sessions using the remote control of the RAT instruments and all other sessions, while taking into account the evaluation criteria; generating a signature for detecting activity indicative of remote control of the RAT tool.

In another embodiment of the method, the analysis determines the parameters of each key event, the time condition, the start indicator of the time condition report, and the environment in which the key events occurred.

In yet another embodiment of the method, the key event parameters are the group to which the key belongs; the presence of a modifier; and the type of action that occurred with the key.

In another embodiment of the method, the characteristic features are at least the following:

• a certain order of key events that occur when entering from the keyboard;

• a temporary condition indicating delays between key events

• indicator of the beginning of the report of the temporary condition;

• activity trigger, after which a comparison with the signature will be made;

• the context in which the comparison with the signature will be made;

• the presence of a particular RAT tool or environment to compare with the signature.

In yet another embodiment of the method, the search for sequences of key events in step c) is performed by creating N-grams of the model.

In another embodiment of the method, for each sequence of key events, the frequency of occurrence in all sessions is determined.

As another embodiment of the present invention, a signature generating system for detecting remote control of a remote administration tool (hereinafter referred to as the RAT tool) is proposed, which includes a data selection module for selecting data about sessions using RAT tools and transmitting to the analysis module; an analysis module for analyzing received data related to keyboard input events and detecting signatures indicative of remote control of the RAT tool, which are passed to the signature generating module; a signature generation module for generating at least one signature based on the difference between the sessions using the RAT and all other sessions by analyzing the received data according to the evaluation criteria.

In another embodiment of the system, the analysis module consists of components: an event recognition module, a data entry rate evaluation module, and a context evaluation module.

In another embodiment of the system, the event recognition module is designed to determine, based on the analysis of the selected data for each key event, such parameters as: the group to which the key belongs, the presence of a modifier, and the type of action that occurred with the key.

In another embodiment of the system, the module for evaluating the rate of data entry is designed to determine the indicator of the beginning of the report of the time of origin of the key event and the delay time between key events.

In yet another embodiment of the system, the context estimator is designed to determine the context in which a key event occurred.

In another embodiment of the system, the signature creation module is designed to search for sequences of key events that will distinguish sessions using RAT tools that are controlled remotely from other sessions.

In yet another embodiment of the system, the signature creation module uses an N-gram model generation approach that allows splitting sequences of session key events into parts, where N-gram is a sequence of n key events.

In another embodiment of the system, the signature creation module is designed to remove part of the created N-grams based on temporary conditions.

In another embodiment of the system, the signature creation module is designed to determine the frequency of occurrence of N-grams in all sessions.

In another version of the system, the signature is described as a sequence of keyboard input events with a time condition and a reference indicator for calculating a given time condition, while the time condition characterizes the delays between adjacent events.

Brief description of the drawings

Additional objects, features and advantages of the present invention will become apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

On FIG. 1 is a block diagram of an activity detection system indicative of remote control of a remote administration tool, with various embodiments possible.

On FIG. 2 is a block diagram of a signature generating system for detecting remote control of a remote administration tool, with the possibility of implementing various embodiments.

On FIG. 3 is a flowchart illustrating a method for generating a signature for detecting remote tampering with a remote administration tool.

On FIG. 4 is a flowchart illustrating a method for detecting activities performed using the remote administration tool.

On FIG. 5 is a block diagram illustrating a particular case of the implementation of the presented method in FIG. 4, namely, a method for detecting fraudulent actions performed using remote administration tools.

Fig. 6 illustrates an example of a general purpose computer system with which the claimed invention may be implemented.

Although the invention may have various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood that the purpose of the description is not to limit the invention to a particular embodiment. On the contrary, the purpose of the description is to cover all changes, modifications, included in the scope of this invention, as defined by the attached claims.

Description of embodiments of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The foregoing description is intended to assist a person skilled in the art in a thorough understanding of the invention, which is defined only within the scope of the appended claims.

The present invention makes it possible to detect such cases of fraud in the field of providing online financial services as gaining unauthorized access to a user's computer using remote administration tools (English Remote Administration Tool, RAT), including such types of malicious programs as a remote access trojan (English Remote Administration Trojan), and programs that perform operations on behalf of the user directly from the user's computer device.

The present invention improves the security of sessions related to financial services through remote administration tools (hereinafter referred to as RAT tools) using a RAT tool remote control detection method. Said method is carried out, in particular, with the aid of the computer device shown in FIG. 6 and includes analysis of occurred events associated with keyboard input and detection of unique sequences of keyboard input events that are specific to the respective RAT tools and not typical at the same time for local (physical or virtual) keyboard input by the user. This allows you to determine the remote control of the RAT tool and detect future fraudulent activities.

In one embodiment, the computing device is a mobile device such as a smartphone or tablet computer. In these cases, the user's local keyboard input also includes virtual keyboard input.

When using a virtual keyboard, when an external keyboard is not available, keyboard input, in particular on mobile devices, is performed using a separate application that displays the keyboard and changes the text directly in the input field of the application in which input is required. An example of such an application is the IME Method. In this case, the event source is the virtual keyboard.

It should be noted that the nature of these sequences of events is due to the features of the remote control protocols used and the specific implementations of such protocols, as well as the current environment of the computer device. The environment is understood to mean, for example, the operating system used, the browser or applications, including the RAT tool. Another feature of such sequences of events, due to their content and taking into account temporary conditions, is the impossibility of playback by the user when physically pressing keys on the local keyboard. In this case, the keyboard can be both physical and virtual.

In addition, the origin of the above events can be associated not only with the use of the local (physical or virtual) keyboard, but also with the use of the keyboard (physical or virtual) of the device from which the RAT is controlled remotely.

In one implementation, the initial information for analysis, such as a stream of ongoing events, among which there are keyboard input events, is collected using a javascript handler that runs in the context of a web page opened in a browser on the user's computer during a session with a remote server providing online financial services.

In addition, when analyzing the information collected, an important aspect is the privacy and protection of the user's personal data. Therefore, the present invention during its execution collects only data (events) that do not contain information about specific keys, but only data about the group to which the key belongs (for example, a letter, number, modifier key, utility key), timing characteristics (speed event origin) and event type (key pressed or released). Thus ensuring the impossibility of identifying the specified user data. Such "anonymous" data is sufficient for the present invention to detect activity that is carried out remotely using the RAT tool to access a remote server, for example, an "online banking" service.

The present invention detects said sequences of keyboard input events in an event stream using generated signatures. The generated signature allows you to determine the activity that is performed remotely (i.e. the user does not perform local keyboard input) on the electronic device using the remote administration tool during interaction with remote services.

Each signature (sample) describes a sequence of keyboard input events (pressing and releasing keyboard keys) with a time condition and a reference indicator for calculating the specified time condition. In this case, the time condition characterizes the delays between adjacent events of pressing and/or releasing the keys. As mentioned earlier, certain timing conditions allow you to separate and define the keys pressed by the software and the keys pressed by the user on the local keyboard.

The following are some embodiments of the claimed invention.

On FIG. 1 is a block diagram of an activity detection system indicative of remote control of a remote administration tool, with various embodiments possible.

An activity detection system indicative of remote control of a remote administration tool (hereinafter referred to as system 100) may be implemented using suitable hardware components and/or software modules, which may be combined or distributed over multiple locations or multiple devices. The components and/or modules of system 100 may interact or communicate over one or more wireless links, wired links, cellular, client/server architecture, peer-to-peer architecture, and the like.

Thus, in one implementation, system 100 includes:

• a browser 115 running on the computer device 110 of the user 105;

• script 117 running in browser 115;

• a remote device 150 that provides services to the user 105 through the computing device 110, such as banking services;

• a discoverer 140 running on the cloud security server 130 and with which the script 117 interacts.

The computing device 110 (hereinafter referred to as the device 110) of the user 105 contains a software execution environment (eg, an operating system) that runs the browser 115.

In general, when interacting with a remote device 150 that provides services to the device 110 through a browser 115, the remote server 150 transmits to the browser 115 a web page, which in turn contains a script 117 (in other words, script code). In one embodiment, script 117 may be written in JavaScript.

Remote device 150 may be at least one of the following devices:

- banking server (provided services: payments, loans, loyalty programs);

- server of a micro-financial organization (payments, loans);

- online store server (loyalty programs);

telecommunications service provider server (payments, loyalty programs);

- server of a logistics (transport) company (payments, loyalty programs).

The script 117 is executed when the web page received from the remote device 150 is opened in the browser 115. The results of the execution of the script 117 are passed to the discoverer 140, which in turn analyzes the results. In one embodiment, the results are transmitted in real time.

In general, while interacting with the remote device 150 through the web page opened in the browser 115 received from the remote device 150, the script 117 monitors and collects data (events) associated with at least actions indicating keyboard input, and with the context of the specified actions. Events related to keyboard input are also called KeyEvents. At the same time, as mentioned above, in order to ensure the privacy and confidentiality of the collected data, information about the directly pressed keys is not collected, but only information is collected about the group of keys, the modifier keys used and the type of action that occurs with the key (pressing or releasing). Examples of key groups are at least the following groups: letter, number, modifier key, and utility key.

To determine the context of actions when interacting with remote device 150, script 117 collects at least one of the following environmental data:

- available information about the browser 115;

- available information about applications interacting with the browser (plugins or external applications), for example, about the remote administration tool (RAT tool) 120;

- available information about the device 110 (eg, operating system, network ports, IP addresses, processor, etc.).

When a web page is opened, the browser 115 sends identification information to the remote device 150. This is a text string that is part of the HTTP request, starting with "User-Agent" and usually including information such as browser name 115, browser version 115, device 110 operating system information (name, version, etc.), language operating system of device 110, and so on. The data containing said information may be received by the script 117 or calculated by the detector 140 based on the information received by the script 117.

The script 120 transmits the collected data about the activity carried out during the session with the remote device 150, the discovery engine 140. In General, the present invention allows you to detect the remote control (administration) of the remote administration tool 120 when interacting with the remote device 150, while the discovery engine 140 detects actions specific to the remote control of the RAT tool 120 when interacting with the remote device 150, based on the analysis of the collected data, containing at least keyboard input events, using signatures. Each signature contains a specific sequence of keyboard input events and takes into account the context of the detected actions.

In one embodiment, the detection means 140 includes a data collection module 142, a data analysis module 144, a decision module 146, and a database 148 including these signatures.

The data collection module 142 is designed to receive data from the script 117, which includes data about keyboard input events occurring in the context of an open web page in the browser 115 on the device 110 in real time, and transmit to the data analysis module 144.

The data analysis module 144 analyzes the detected keyboard input events, during which it determines for each event the groups of keys pressed, recognizes the type of operations performed (for example, a keyboard key is pressed or released), and determines the temporal conditions of the detected events (time delays between adjacent events). Based on the determined data, module 144 generates sequences of keyboard input events with an appropriate context that at least contains information about the operating system, browser type 115, and the RAT tool 120 being used.

The decision module 146 compares the generated sequences of keyboard input events with signatures from the database 148. Each signature contains a sequence of keyboard input events specific to a particular RAT tool 120. Such a signature (signature of the first type) allows you to identify actions that indicate remote control of the RAT tool 120. Therefore, if at least one signature matches, module 146 makes a decision to remotely control the RAT 120.

In other words, the signature contains a specific order in which keypress and release events are displayed during a remote device interaction session 150 using the RAT tool 120 with a time condition for each event to occur and a report start indicator to calculate the time condition.

In yet another particular case, the database 148 contains signatures that make it possible to uniquely determine that the keyboard input was from a local input device, such as a physical or virtual keyboard, i. remote control was not performed (signature of the second type). In this case, the decision module 146 may perform an additional check if the first signature matches, or perform a comparison with the signatures of the second type during the main comparison. If a signature of the second type is detected, make a decision on the local management of the RAT tool. This additional verification with type 2 signatures reduces the chances of Type 1 and Type 2 errors. In cases where the main check and the second type of signature check are carried out, the time to check the session of interaction with the remote device 150 for fraud can be reduced.

In one implementation, the detection engine 140 can additionally detect fraudulent activities performed using the RAT tools 120. For example, if the detection engine 140 detects activity that indicates the remote control of the RAT tool 120, and if the remote device 150 is a banking server, the detection means 140 can decide with the help of the module 146 about fraudulent behavior and take actions aimed at protecting the device 110 of the user 105 from online fraud. For example, such actions are interrupting the process of the RAT tool 120 or a network port, blocking the session with the online service, breaking the connection to the remote device 150, and informing the user 105 using alternative means of communication about the detected activity. These locks can be performed using script 117.

In yet another implementation, the discoverer 140 is implemented in conjunction with the script 117.

In another implementation, the script 117 performs all or part of the tasks of the discoverer 140. For example, the script contains a database 148 and compares the occurring events from the data stream with signatures from the database 148. Based on the results of the comparison, it makes an appropriate decision.

On FIG. 2 is a block diagram of a signature generating system for detecting remote control of a remote administration tool (hereinafter referred to as a signature generating system) 200, with the possibility of implementing various embodiments. The principle of searching and generating new signatures is based on the difference in data between sessions using RAT tools and other sessions using testing and anomaly detection methods. An anomaly in this case refers to a unique sequence of events indicating the pressing and releasing of keys while typing on the keyboard (keyboard input), which are typical only for remote input through the RAT 120 tool. This may take into account other features of such activity, for example, the environment and the context of the origin of the events. Environment refers, as mentioned above, to the environment in which the activity takes place, such as running applications and type of operating system. Examples of applications are the browser "Internet Explorer" and the RAT tool - "Teamviewer". The context is understood, for example, as the features of the session during which the activity is performed: the user on the Windows operating system works through a window on the Linux operating system. Other examples of context include displaying an application's menu bar or using different text input languages.

In general, the signature generation system 200 receives a set of data, for example, from a cloud security server 130. The data set contains at least information about sessions using RAT tools 120 and sessions without using RAT tools, as well as information about the environment or context in which sessions took place. Sessions using RAT tools contain data about sessions with and without remote control of the RAT tool. Session data is at least information about keyboard input events that have occurred. Keyboard input events are also referred to as keyboard input events. An example of environment information is information about the computer, applications, browser, operating system, and RAT tool. The data set can be collected in various ways, for example, using the cloud security server 130 itself or provided by third party devices.

In a general implementation, the cloud security server 130 accumulates historical data about sessions with remote devices 150 using the RAT tools 120, that is, it collects data about activities already performed using the RAT tools. Such data may be collected during the testing of RAT tools, for example, when a new version is released. Also in the process of remote connection using RAT tools when providing any assistance to the user with his consent.

Signature generation system 200 may be implemented using suitable hardware components and/or software modules, which may be co-located or distributed across multiple locations or multiple devices. For example, using the computing device shown in FIG. 6.

In one embodiment, the signature generation system 200 includes a data sampling module 220, an analysis module 240, and a signature generation module 260. In turn, the analysis module 240 may be functionally divided into an event recognition module 242, an input rate evaluation module 244, and a context evaluation module. 246.

The data selection module 220 is designed to initially select session data using the RAT tools 120. The module 220 then passes the data to the analysis module 240.

The analysis module 240 is designed to analyze the received data associated with keyboard input events and identify signatures to create new signatures. The features sought are data that allows remote control of the RAT 120 to be detected during a session with the remote device 150. Such data may be at least some of the following:

• a certain order of key events when entering using the keyboard (sequence of keyboard input events);

• a temporary condition indicating delays between key events;

• indicator of the beginning of the report of the temporary condition;

• activity trigger, after which a comparison with the signature will be made;

• the context in which the comparison with the signature will be made;

• the presence of a particular RAT tool or environment to compare with the signature.

So, at the first stage, using the event recognition module 242, based on the analysis of the selected session data using the RAT 120 tools, such parameters are determined for each key event as: the group to which the key belongs, the presence of a modifier and the type of action that occurred with the key. Examples of groups are: letter, arrow, action, number, and others. Modifiers are such keys as: "ctrl", "alt" and "shift". The type of action is understood as pressing or releasing a key.

In the second step, the input rate estimation module 244 analyzes the time of occurrence of key events and the delays between key events. Those events with delays between key events exceeding 100 ms will not be taken into account, because. can be committed physically by the user when entering characters on the keyboard. In some cases, a 50 ms boundary may be specified in order to provide as much separation as possible with the user's capabilities. This statement is based on the fact that a person types at a limited speed, so not every key sequence can be reproduced by a person for temporary reasons. For example, for the average user, the delay takes about 300ms per character, including two events - key down and key up. Accordingly, one key event takes ~ 150 ms.

Therefore, events that fall in the range from 0 to 100 ms will be taken into account in the future, since they are most likely created by the software. In this case, it is possible to determine the spent exact time interval between adjacent events and the beginning of the time condition report.

At the third stage, using the context evaluation module 246, an analysis is made of data containing information about the environment in which the analyzed sessions were performed in order to determine the context of the sessions and its impact on the sessions, or rather on the events that occurred. This information includes at least information about the RAT tool, browser, and operating system. The presence of certain applications affects the occurrence of certain keyboard input events.

As a result of the study, the analysis module 240 will generate data for generating a signature. The generated data is passed to the signature generation module 260, which in turn generates a signature based on the received data.

Signature generation module 260 first searches for sequences of key events that distinguish sessions using RAT tools that are controlled remotely from other sessions. To do this, in one implementation, module 260 uses the approach of creating N-grams (N-grams) of the model, which allows you to divide the sequence of key events of the sessions into parts. N-gram - a sequence of n elements, namely, from keyboard events.

It should be noted that with the help of N-grams, sequences are divided into fixed segments of N-length with overlap. For example, for four events [1,2, 3,4]: if the events are divided into 2-grams, then this will lead to the following form: [1,2], [2, 3], [3, 4].

Consider an example of the formation of N-grams, the length of which will be equal to four.

Module 260, based on the received data on key events and their timing conditions, creates two sets of 4-grams (grams) of events, where one set corresponds to all sessions, and the second to sessions produced using RAT tools. So, each 4-gram consists of 4 keys. Each key represents the following collection (<group>, <modifier>, <event type>). For example, one key collection contains information: Action, -, Down. This means a key from the "actions" group that was pressed without modifiers.

Next, the module 260 removes N-grams from the sets, which, for example, are longer than 50 ms, based on temporal conditions. It is worth noting that the number of all sessions can significantly exceed the number of sessions with the RAT tool. Accordingly, the proportion for sets of N-grams will be similar.

Next, module 260 constructs a marginal probability distribution (LDP) of the frequencies of occurrence of each set of N-grams and selects only those sets of N-grams that correspond to a certain probability range. Thus, for each set of N-grams, module 260 determines the frequency of its occurrence in all sessions, including sessions in which the remote control of the RAT tool was used. The N-grams from the set of sessions using the RAT tools are then ranked by their frequency of occurrence both for the RAT session and for the entire population of sessions, and analyzed according to the scoring criteria. Thus, if an N-gram is present in sessions using the RAT and absent from other sessions, or if the frequency of occurrence is minimal, then this N-gram is a candidate for creating a signature. Another criterion is the evaluation of the context in which the sequence was revealed in the sessions in which the remote control of the RAT tool was carried out, and in the remaining sessions, since. this makes it possible to find an additional distinguishing criterion. Another criterion is the evaluation of the time condition during which it is possible to change the time condition in order to limit the sessions that can be detected. The time condition can indicate delays for the entire sequence or for each event individually. Another criterion is a trigger pointing to the initial state for comparison and signature detection. It should be noted that the set of evaluation criteria is used depending on the need. In addition, when creating a signature, several criteria of the same type can be used, for example, two or more sequences of key events.

Next, module 260 generates at least one signature based on the difference between sessions using the RAT and all sessions, while taking into account the specified criteria. An example of a signature for detecting RAT remote control activity during a session with remote device 150 is a signature of the following form:

"Signature name containing information about the RAT tool and context:

• at least one sequence of key events (key input events);

• temporary conditions for the occurrence of these events, while the conditions may change from event to event;

• trigger, based on which the specified sequence is compared with the current flow of events;

• the presence of an appropriate context when the signature fires”.

So, for example, a combination of four key events can be used as a sequence: (Meta, Shift, Up), (Numeric, -, Up), (Numeric, -, Down), (Numeric, -, Up); as a temporary condition, the time of origin between events is less than 60 ms; as a trigger - pressing the "Caps Lock" key and using the Russian keyboard; and as a context, the presence of the TightVNC application and the Internet Explorer 11 browser.

It is worth noting that the signature can cover both one RAT tool and several.

In yet another embodiment, the signature generation system 200 similarly further generates signatures to identify activity during a session using the RAT tool and indicate that a local keyboard has been used for data entry. Such signatures will determine the legitimacy of using the RAT tool during the session. Only in this case, for example, is a keyboard input sequence defined that unambiguously indicates that the local keyboard was used for input. In yet another signature example, a timing condition (time distance between adjacent events) is defined that, if greater than a certain value, then the keyboard input event chain was created by the user using local input devices. Such signatures will minimize false positives when detecting activity indicating remote control of the RAT tool if used as an additional check if one of the main signatures has worked.

On FIG. 3 is a flowchart illustrating a method for generating a signature for detecting remote tampering with a remote administration tool. The presented method is implemented using the system described in FIG. 2. Suppose you want to test a certain set of data.

At 310, module 220 obtains an initial set of session data during which the RAT tools were used. At the same time, RAT tools were managed both from a local computer and using remote control.

At step 320, analysis is carried out using module 240 of the received data in order to identify signatures for activity indicating remote control of the RAT tool during the session. Data refers to at least a stream of keyboard input events. Such characteristic features may include at least the following:

• a certain order of key events that occur when entering from the keyboard (sequence of keyboard input events);

• a temporary condition indicating delays between key events;

• indicator of the beginning of the report of the temporary condition;

• activity trigger, after which a comparison with the signature will be made;

• the context in which the comparison with the signature will be made;

• the presence of a particular RAT tool or environment to compare with the signature.

So, in the process of analysis, the parameters of each key event are first determined, namely: the group to which the key belongs; the presence of a modifier; and the type of action that occurred with the key. Then, a time condition (time delays between adjacent key events) and a time condition report start indicator are determined. This eliminates key events that exceed a predetermined value, for example, 50 ms. The environment in which the key events occurred is then determined in order to further determine the context of the key event. As a result of the analysis, module 240 generates data for further evaluation and signature generation.

At block 330, module 260 searches for sequences of key events that will distinguish sessions using RAT tools that are controlled remotely from others. To do this, using the N-gram model generation approach presented in the description of FIG. 3, the stream of key events of each session is divided into parts, forming sequences of key events from them. At the same time, associating with each specified sequence information about temporary conditions and the environment.

At step 340, module 260 determines, for each sequence of key events, the frequency of its occurrence in all sessions, including sessions in which the remote control of the RAT instrument was used. Additionally, key event sequences can be ranked by frequency of occurrence in sessions.

At step 350, key event sequence module 260 evaluates based on the difference between sessions using RAT remote control and all other sessions, while taking into account evaluation criteria and frequency of occurrence. Examples of evaluation criteria are presented in the description of FIG. 2. If, according to the evaluation, features are found that allow remote control of the RAT tool during the session, then proceed to step 360. Otherwise, if these features are not found, then return to step 310.

At step 360, at least one signature is generated using module 260 based on the characteristic features. An example of a generated signature is shown in the description of FIG. 2.

On FIG. 4 is a flowchart illustrating a method for detecting activity performed remotely using a remote administration tool. Activity refers to a series of actions performed. The presented method is implemented using the system described in FIG. 1. It should be noted that the steps of the method can be executed both in real time and with some time delay.

At block 410, script 117 collects data in the form of events associated with at least the actions that indicate keyboard input and the context in which the events occur. It should be noted that during the collection of data, the privacy and confidentiality of the user's personal data is ensured in such a way that it is impossible to identify the specified data. For example, by collecting data that includes only data about the group to which the key belongs, timing and type of event. The collection of data includes tracking keyboard input events in the browser event stream 115 during a session with remote device 150. A keyboard input event describes a key action performed on a keyboard input.

At step 420, script 117 compares the keyboard input events from the event stream with signatures from the database 148, which is merged with script 117. Each signature is a sequence of keyboard input events (pressing and releasing keyboard keys) with a time condition and a start indicator to calculate the given time condition. Signature comparison includes pre-analysis of keyboard input events and searching for a specific sequence of keyboard input events that are specific to remote control of the remote administration tool, given the context. Said analysis of keyboard input events is performed by a detection tool 140 combined with a script 117 and includes:

определение для каждого события клавиатурного ввода:

definition for each keyboard input event:

• the group to which the key belongs;

• the presence of a modifier used with the key;

• type of performed operations (pressing or releasing a key);

определение временных условий, указывающих на время задержки между соседними событиями, и индикатора начала отчета времени;

determining timing conditions indicative of a delay time between adjacent events and a start indicator of timing;

определение контекста, при котором произошло событие.

determining the context in which the event occurred.

After analysis, a comparison is made with signatures corresponding to the context. The comparison searches for a specified sequence of keyboard input events. A signature is considered found in the event stream if all the signature conditions are met, including a specific keyboard input sequence.

At 430, if at least one signature matches, activity indicative of remote control of the remote administration tool is detected.

On FIG. 5 is a block diagram illustrating a particular case of the implementation of the presented method in FIG. 4, namely, a method for detecting fraudulent actions performed using remote administration tools. To do this, using the script 117, which is executed in the context of an open web page in the browser 115, control over the actions associated with keystrokes during the session with the remote device 150 is carried out. analysis by script 117. The following steps are performed in the control process.

Steps 510 and 520 are similar to steps 410 and 420, in which keyboard input events are collected and compared with signatures from database 148. If, at step 530, the signature is found in the browser event stream 115, then proceed to step 540. Otherwise, return to step 510.

At step 540, a decision is made to detect the remote control of the RAT 120.

At step 550, a further analysis of the session is carried out using the RAT 120 detected by the tool. The analysis is aimed at assessing the ongoing activities and identifying activities associated with suspicious behavior characteristic of fraudulent activities.

At step 560, a decision is made to detect online fraud.

At an additional step 570, actions are taken to protect against online fraud. Examples of these actions are presented in the description of FIG. one.

Fig. 6 represents an example of a general purpose computer system 20 that can be used as a client computer (eg, a personal computer) or a server shown in FIG. 2. Computer system 20 includes a CPU 21, system memory 22, and a system bus 23 that contains various system components, including memory associated with the CPU 21. System bus 23 is implemented as any bus structure known in the art, comprising in turn, a bus memory or bus memory controller, a peripheral bus, and a local bus that is capable of interfacing with any other bus architecture. System memory contains a read only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains the main procedures that ensure the transfer of information between elements of the computer system 20, for example, at the time of loading the operating systems using ROM 24.

The computer system 20 in turn comprises a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31 such as CD-ROM, DVD -ROM and other optical storage media. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 via the hard disk interface 32, the magnetic disk interface 33, and the optical drive interface 34, respectively. Drives and related computer storage media are non-volatile means of storing computer instructions, data structures, program modules, and other data of computer system 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that are capable of storing data in a computer-readable form (solid-state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55.

The computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38 and program data 39. The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40, manipulator " mouse" 42). Other input devices (not shown) may be used: microphone, joystick, game console, scanner, etc. Such input devices are typically connected to computer system 20 via serial port 46, which in turn is connected to the system bus, but may be connected in other ways, such as through a parallel port, game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not shown), such as speakers, a printer, etc. .

The computer system 20 is capable of operating in a networked environment using a network connection to another or more remote computers 49. The remote computer(s) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the entity description. computer system 20 shown in FIG. 6. Other devices may also be present in the computer network, such as routers, network stations, peering devices, or other network nodes.

The network connections may form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the computer system (personal computer) 20 is connected to a local area network 50 via a network adapter or network interface 51. When networks are used, the personal computer 20 may use a modem 54 or other means to communicate with a wide area network, such as the Internet. . Modem 54, which is an internal or external device, is connected to system bus 23 via serial port 46. It should be clarified that network connections are only exemplary and are not required to represent the exact network configuration, i. in fact, there are other ways to establish a connection by technical means of communication from one computer to another.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention defined by the formula. A person skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (48)

1. A method for generating a signature for detecting remote control by a remote administration tool (hereinafter referred to as the RAT tool), which includes the steps at which: a. getting a set of session data including sessions during which the RAT tools were remotely controlled; b. analyze the received data in order to identify characteristic features that indicate remote control of the RAT tool and include: i. a certain order of key events that occur when entering from the keyboard, while defining the parameters of each key event: - the group to which the key belongs, - the presence of a modifier, - the type of action that occurred with the key, ii. timing conditions indicating delays between adjacent events; in. searching for sequences of key events that will distinguish sessions using RAT tools that are controlled remotely from other sessions, based on the creation of an N-gram model based on data on key events and temporal conditions; d. evaluate sequences of key events based on the difference between sessions using remote control of the RAT instruments and all other sessions, while taking into account the evaluation criteria; e. generating a signature for detecting activity indicative of remote control of the RAT tool based on the difference between sessions using the RAT tools and all sessions, the signature containing at least one sequence of key events with timing conditions for the occurrence of said events. 2. The method according to p. 1, in which the groups to which the key belongs are at least a letter, an arrow, an action and a number; modifiers are such keys as: "ctrl", "alt" and "shift"; and the type of action that occurred on the key indicates whether the key was pressed or released. 3. The method of claim 1, wherein the additional features are at least the following: - indicator of the beginning of the report of the temporary condition; - activity trigger, after which a comparison with the signature will be made; - the context in which the comparison with the signature will be made; - the presence of a specific RAT tool or environment to compare with the signature. 4. The method according to claim 3, in which the following is additionally determined during the analysis: a. timing conditions indicating delays between key events, with events having delays between key events exceeding 100 ms being excluded; b. a time condition report start indicator for determining the exact time interval between adjacent events; in. the environment in which the key events occurred, such as information about the RAT, browser, and operating system. 5. The method according to claim 1, in which an N-gram model is created that separates the sequences of key events of sessions into parts, with the subsequent formation of a limiting probability distribution of the frequencies of occurrence of each set of N-grams, while based on data on key events and their time conditions, two sets of 4-gram events are created, where one set corresponds to all sessions, and the second to sessions produced using RAT tools. 6. The method according to p. 1, in which the evaluation criteria are: a. the frequency of occurrence of N-grams both for a session with RAT tools and for the entire set of sessions; b. assessment of the context in which the sequence of key events was detected in sessions in which the remote control of the RAT instrument was carried out and other sessions; in. assessment of the temporary condition; d. activity trigger. 7. Signature generation system for detecting remote control of the remote administration tool (hereinafter referred to as the RAT tool), which includes: a. a data selection module for selecting session data using the RAT tools and passing it to the analysis module; b. an analysis module designed to analyze the received data associated with keyboard input events and identify characteristic features that indicate remote control of the RAT tool, including: i. a certain order of key events that occur when entering from the keyboard, while defining the parameters of each key event: - the group to which the key belongs, - the presence of a modifier, - the type of action that occurred with the key, ii. timing conditions indicating delays between key events that are passed to the signature generation module; in. a signature generation module designed to generate at least one signature based on the difference between sessions using RAT tools and all other sessions, by searching for sequences of key events that will distinguish sessions using RAT tools that are controlled remotely from the rest of the sessions, based on the creation of an N-gram model based on data on key events and temporal conditions, and subsequent evaluation of sequences of key events according to the evaluation criteria, while the signature contains at least one sequence of key events with temporal conditions for the occurrence of these events. 8. The system according to claim. 7, in which the analysis module consists of components: an event recognition module, an input rate evaluation module, and a context evaluation module. 9. The system according to claim 8, in which the event recognition module is designed to determine, based on the analysis of the selected data for each key event, such parameters as: the group to which the key belongs, the presence of a modifier, and the type of action that occurred with the key. 10. The system of claim. 8, in which the input rate estimation module is designed to determine the indicator of the beginning of the report of the time of origin of the key event and the delay time between key events. 11. The system of claim. 8, in which the context evaluation module is designed to determine the context in which the key event occurred. 12. The system of claim. 7, in which the signature creation module is designed to search for sequences of key events that will distinguish sessions using RAT tools that are controlled remotely from other sessions. 13. The system according to claim 7, in which the signature creation module uses the approach of creating N-grams of the model, which allows to divide the sequence of key events of sessions into parts, where N-grams is a sequence of n key events, with the subsequent formation of the limiting probability distribution of the frequencies of occurrence of each a set of N-grams, while based on data on key events and their time conditions, two sets of 4-gram events are created, where one set corresponds to all sessions, and the second to sessions produced using RAT tools. 14. The system of claim. 13, in which the signature creation module is designed to remove part of the created N-grams based on temporary conditions. 15. The system of claim. 7, in which the signature creation module is designed to determine the frequency of occurrence of N-grams in all sessions. 16. The system according to claim 7, in which the generated signature additionally includes: a. information about the RAT tool and context, b. temporal conditions for the occurrence of events, while the temporal condition characterizes the delays between adjacent events, in. a trigger based on which the specified sequence is compared with an ongoing stream of events.

Images