Understanding and Mitigating Banking Trojans: From Zeus to Emotet

TL;DR

This paper analyzes the evolution of banking Trojans like Zeus and Emotet, highlighting their increasing sophistication and proposing a multi-layer network security system combining graphical models and game theory to effectively block Trojan communications.

Contribution

It introduces a novel multi-layer network security approach using graphical and game theoretic models to detect and prevent banking Trojan activities on modern heterogeneous networks.

Findings

The proposed system effectively blocked Trojan network communications.

Experimental results showed prevention of data leakage.

The approach demonstrated promising results for future cybersecurity defenses.

Abstract

Banking Trojans came a long way in the past decade, and the recent case of Emotet showed their enduring relevance. The evolution of the modern computing landscape can be traced through Emotet and Zeus, both representative examples from the end of the past decade. As an example of earlier malware, Zeus only needed to employ simple anti-analysis techniques to stay undetected, while the more recent Emotet had to constantly evolve to stay a step ahead. Current host-based antimalware solutions face an increasing number of obstacles to perform their function. A multi-layer approach to network security is necessary for network-based intrusion response systems to secure modern networks of heterogeneous devices. A system based on a combination of a graphical network security model and a game theoretic model of cyber attacks was tested on a testbed with Windows machines infected with Trojans, experimental results showed that the proposed system effectively blocked Trojans network communications effectively preventing data leakage and yielding encouraging results for future work.