I'm searching for keylogger detection. As far as I see, almost all of keyloggers created by tools are sending data to a host periodically, but the ones made by coders may send data non-periodically. Because it is easy to detect periodic events by listening traffic of a host, some professional hackers(code writers) does such a trick: create a random
min1 and after
hour1:min1 send the first keystrokes data(or whatever it is sending to hacker). After sending first set of data, randomly create
min2 and after
hour2:min2 send the next data and so on.
With this tecnic they are getting data non-periodically, but regularly. Is there any way/trick to find out that non-periodic but regular data upload?
Note: I'm not interested in Command and Control for now. I'm only interested in non-periodically data uploading keylogger detection? Ideas related to non-periodic and regular event detection would be appreciated.
Note2: Most of keyloggers are sending data over gmail or another mail server and some of them are using ftp server.
Note3: The detection is not going to be host based but
network based detection.