Karim Khamaisi

Last Name

Khamaisi

First name

Karim

Email

karim.khamaisi@unisg.ch

Now showing 1 - 1 of 1

Some of the metrics are blocked by your
consent settings
Moving Target Offense: RL-Based Adaptive Evasion Strategies for C2 Frameworks
(2025-07-23)
Karim Khamaisi
;
Anton Crazzolara
;
Aleksandar Ristic
;
Samuel Brugger
;
Bruno Rodrigues
Modern Intrusion Detection Systems (IDS) that rely on signature-based detection struggle to detect novel threats like AI-based Command-and-Control (C2) frameworks, highlighting a gap in the ability of current systems to detect and mitigate emerging botnet threats. This work addresses this gap by investigating NimPlant's detection and evasion capabilities. This paper (1) shows strategies to detect NimPlant bots using network traffic analysis, (2) enhances their evasion capabilities using Reinforcement Learning (RL), and (3) evaluates AI-driven evasion against IDS. Using a controlled testing environment, an infected device is simulated by implementing evasion strategies and integrating them into an RL-based AI system. Herewith, AI significantly improves evasion, with the RL-enhanced NimPlant achieving higher detection bypass rates. However, the IDS configuration heavily impacts AI effectiveness, underscoring the need for robust security setups. Thus, recommendations are provided for detecting bot infections and countering AI-enhanced botnets.
Type:conference paper
URL:https://ieeexplore.ieee.org/abstract/document/11146346/
URI:https://www.alexandria.unisg.ch/handle/20.500.14171/123178