EarlyCrow: Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries

2025-02-07

Information Security Conference

AI Summary

To address the challenge of advanced persistent threat (APT) groups leveraging HTTP(S) for stealthy command-and-control (C2) communications that evade mainstream network intrusion detection systems (NIDS), this paper proposes a lightweight, real-time detection framework based on contextual summarization. Our method innovatively integrates cross-session behavioral modeling and semantic-aware traffic summarization, overcoming limitations of single-request feature analysis and encrypted-traffic black-box inspection. It jointly leverages HTTP protocol parsing, session graph construction, temporal context encoding, and contrastive learning for anomaly scoring. Evaluated on real-world APT samples and large-scale background traffic, our framework achieves 98.3% detection rate, 0.12% false positive rate, and average latency under 3.2 seconds—significantly outperforming existing state-of-the-art approaches. The core contribution is the first realization of fine-grained, low-overhead, and high-temporal-resolution contextual awareness for HTTP(S) C2 traffic.

Technology Category

• Natural Language Processing: Summarization
• Data Mining & Knowledge Management: Semantic Web
• Computer Vision: Object Detection & Categorization

Application Category

• Web Mining and Content Analysis: Normalization, clustering, classification, and summarization of Web text
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Problem

• Detect APT malware command and control
• Focus on HTTP(S) using contextual summaries
• Improve detection accuracy with PairFlow format

Innovation

• Contextual summaries for APT detection
• PairFlow network flow format
• Behavioral and statistical protocol analysis