title: ÐÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð½ÐµÑÐ°Ð½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÐºÐ°Ð½Ð°Ð»Ð¾Ð² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÐ·Ð»Ð°Ð¼Ð¸ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½Ð¾Ð¹ ÑÐµÑÐ¸, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ñ Ð¾Ð±Ð¾Ð»Ð¾ÑÐºÑ Meterpreter
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: A method for detecting unauthorized control channels of computer network nodes that use the Meterpreter shell
Creators: name: ÐÐ¾ÑÑÐ½Ð¸ÐºÐ¾Ð²Ð°, Ð®Ð»Ð¸Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ðµ ÑÐºÑÑÑÐ¾Ð³Ð¾ ÐºÐ°Ð½Ð°Ð»Ð° ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ
meterpreter
Ð¼ÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ meterpreter
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
ÑÐ»ÑÑÐ°Ð¹Ð½ÑÐ¹ Ð»ÐµÑ
construction of a hidden control channel
meterpreter detection method
machine learning
random forest

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð½ÐµÑÐ°Ð½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÐºÐ°Ð½Ð°Ð»Ð¾Ð² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÐ·Ð»Ð°Ð¼Ð¸ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½Ð¾Ð¹ ÑÐµÑÐ¸, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ñ Ð¾Ð±Ð¾Ð»Ð¾ÑÐºÑ MeterpreterÂ». Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÑÑÐ¸Ð¸ Meterpreter Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð´Ð°Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ ÑÐ²Ð»ÑÑÑÑÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÐºÑÑÑÑÑ ÐºÐ°Ð½Ð°Ð»Ð¾Ð² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÐ·Ð»Ð°Ð¼Ð¸ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½Ð¾Ð¹ ÑÐµÑÐ¸, ÑÐµÑÐµÐ²Ð¾Ð¹ ÑÑÐ°ÑÐ¸Ðº ÑÐµÑÑÐ¸Ð¸ Meterpreter, Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð¡Ð»ÑÑÐ°Ð¹Ð½ÑÐ¹ Ð»ÐµÑ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ:ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¸ ÑÑÐµÐ´ÑÑÐ² Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÐºÑÑÑÑÑ ÐºÐ°Ð½Ð°Ð»Ð¾Ð² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÐ·Ð»Ð°Ð¼Ð¸ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½Ð¾Ð¹ ÑÐµÑÐ¸. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¹ Ð¿Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÑÑÐ¸Ð¸ Meterpreter. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐºÑÑÑÑÑ ÐºÐ°Ð½Ð°Ð»Ð¾Ð² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ñ Ð¾Ð±Ð¾Ð»Ð¾ÑÐºÑ Meterpreter, Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. ÐÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð°Ñ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð°. ÐÐ¾Ð´Ð±Ð¾Ñ Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ¾Ð² Ð´Ð»Ñ ÑÐ»ÑÑÑÐµÐ½Ð¸Ñ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ¾Ð² Ð¾Ð±ÑÑÐµÐ½Ð½Ð¾Ð¹ Ð¼Ð¾Ð´ÐµÐ»Ð¸.Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸Ð·ÑÑÐµÐ½Ñ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸ ÑÑÐµÐ´ÑÑÐ²Ð° Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÐºÑÑÑÑÑ ÐºÐ°Ð½Ð°Ð»Ð¾Ð² ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ ÑÐ·Ð»Ð°Ð¼Ð¸ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½Ð¾Ð¹ ÑÐµÑÐ¸, Ð¸Ð·ÑÑÐµÐ½Ñ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÐ¸ Ð¾Ð±Ð¾Ð»Ð¾ÑÐºÐ¸ Meterpreter, Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, ÑÐµÑÐ°ÑÑÐ¸Ðµ Ð·Ð°Ð´Ð°ÑÑ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐºÐ°Ð½Ð°Ð»Ð¾Ð², Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ñ Ð¾Ð±Ð¾Ð»Ð¾ÑÐºÑ Meterpreter, Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. Ð¡Ð»ÑÑÐ°Ð¹Ð½ÑÐ¹ Ð»ÐµÑ, Ð¿Ð¾Ð´Ð¾Ð±ÑÐ°Ð½Ñ Ð¾Ð¿ÑÐ¸Ð¼Ð°Ð»ÑÐ½ÑÐµ Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÑ Ð¼Ð¾Ð´ÐµÐ»Ð¸ Ð´Ð»Ñ Ð»ÑÑÑÐµÐ³Ð¾ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ°. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ ÑÑÐµÐ´ÑÑÐ²Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¾Ð±ÑÐ°ÑÐ½Ð¾Ð¹ Ð¾Ð±Ð¾Ð»Ð¾ÑÐºÐ¸ Meterpreter.
description: The topic of the graduate qualification work is Â«A method for detecting unauthorized control channels of computer network nodes that use the Meterpreter shellÂ».The purpose of the study is development of a Meterpreter session detection method using machine learning methods. The subject of the work are methods for constructing hidden control channels of computer network nodes, network traffic of the Meterpreter session, a Random Forest machine learning algorithm. The research set the following goals:Research of methods and means of constructing hidden control channels of computer network nodes.Research of existing solutions for detecting the Meterpreter session.Development of a method for detecting hidden control channels that use the Meterpreter shell, using machine learning algorithms.Software implementation of the developed method.Selection of parameters to improve the results of the trained model.During the work methods and means of constructing hidden control channels for computer network nodes were studied. The capabilities of the Meterpreter shell were studied. Machine learning algorithms solving the classification problem were investigated.As a result of the work, a Meterpreter shell channel detection tool was developed, based on the Random Forest machine learning algorithm, optimal model parameters were selected for the best result. The results could be used as means of detecting Meterpreter reverse shell.