Parallel-SWSA: Automated Extraction for Feature Sequences from Remote Access Trojan Attack Packets

Remote Access Trojans (RATs) are malware that allow attackers to remotely control infected systems and steal sensitive user data via the internet. Although current detection methods based on network traffic rules are widely adopted due to their efficiency and accuracy, writing these rules heavily relies on expert knowledge and is costly. This is incredibly challenging when extracting rules for obfuscated Trojans. To achieve effective and efficient RAT detection, this paper proposes a Parallel Sliding Window Sequence Alignment (Parallel-SWSA) algorithm. This method uses a sliding window to segment the data, then uses the Jaccard Similarity coefficient to calculate the similarity between sequences within the window, selects the most similar sequence pairs for alignment one by one, and extracts the common feature sequences. By introducing parallel processing techniques, the extraction efficiency of the feature sequences is significantly improved. Additionally, we developed an automatic conversion tool for Snort rules to address the issue of labor-intensive rule writing. This tool can automatically transform extracted feature sequences into Snort-compatible rules, suitable for intrusion detection systems that support Snort rules. The Parallel-SWSA algorithm was validated on five datasets and achieved high detection rates. The results indicate that the method can effectively extract malicious feature sequences generated during RAT communication and possess strong noise resistance capability.