Moving Target Offense: RL-Based Adaptive Evasion Strategies for C2 Frameworks
Type
conference paper
Date Issued
2025-07-23
Author(s)
;
Anton Crazzolara
;
Aleksandar Ristic
;
Samuel Brugger
;
;
Stiller, Burkhard
Abstract
Modern Intrusion Detection Systems (IDS) that rely on signature-based detection struggle to detect novel threats like AI-based Command-and-Control (C2) frameworks, highlighting a gap in the ability of current systems to detect and mitigate emerging botnet threats. This work addresses this gap by investigating NimPlant's detection and evasion capabilities. This paper (1) shows strategies to detect NimPlant bots using network traffic analysis, (2) enhances their evasion capabilities using Reinforcement Learning (RL), and (3) evaluates AI-driven evasion against IDS. Using a controlled testing environment, an infected device is simulated by implementing evasion strategies and integrating them into an RL-based AI system. Herewith, AI significantly improves evasion, with the RL-enhanced NimPlant achieving higher detection bypass rates. However, the IDS configuration heavily impacts AI effectiveness, underscoring the need for robust security setups. Thus, recommendations are provided for detecting bot infections and countering AI-enhanced botnets.
File(s)![Thumbnail Image]()
open.access
Name
LCN25-MovingTargetOffense.pdf
Size
1.66 MB
Format
Adobe PDF
Checksum (MD5)
d5cf282826a8a9d813ccfa3194c9ef09