118 reputation
3
bio website
location UAE
age
visits member for 1 year, 9 months
seen Nov 8 at 9:38

Feb
22
awarded  Supporter
Feb
20
comment non-periodic event detection
Both size and fixed timer are used while creating a keylogger by a tool. All tools I have seen uses one of them. The things you have offered are both host based but we are more into network based security. In the case of keyloggers, connection is opened from the host to (let say) smtp.gmail.com then immediately after data is started to be sent. This may be a characteristic of keyloggers, isn't it? Do you think, we can follow this path/idea?
Feb
19
asked non-periodic event detection
Feb
11
awarded  Scholar
Feb
11
accepted keylogger detection by listening network
Feb
9
comment keylogger detection by listening network
Is there anyway to differenciate any of keyloggers by looking at network traffic? For example, as far as I know periodicity is an issue for some keyloggers, I mean, they may be sending data periodically to a server. also some of them are sending data when they reach a determined amount of data, let say send mail when you reach 100 KB, etc. Is there more of that kind if issues that may help us to find out keyloggers?
Feb
8
comment keylogger detection by listening network
@Dinu S: is there any difference with keyloggers activity and normal activites in terms of ways to send data. For example, when I send a data over gmail, is it same with keyloggers way of sending data? Is there any possible differences in some of these issues that we can differenciate whether it is normal activity or keylogger activity by looking at this difference?
Feb
7
awarded  Student
Feb
7
asked keylogger detection by listening network