University of St. Gallen

← Publications

Moving Target Offense: RL-based Adaptive Evasion Strategies for C2 Frameworks

Karim Khamaisi, Anton Crazzolara, Aleksandar Ristic, Samuel Brügger, Bruno Rodrigues, Jan von der Assen, Burkhard Stiller

IEEE Conference on Local Computer Networks (LCN) (venue) · Sydney, Australia, 14-16 October 2025 · 2025

Preprint IEEE
Figure from Moving Target Offense: RL-based Adaptive Evasion Strategies for C2 Frameworks

Signature-based intrusion detection struggles against novel, AI-driven Command-and-Control frameworks. This paper takes the attacker’s view to sharpen the defense: it shows how to detect NimPlant C2 bots from network traffic, then uses reinforcement learning to strengthen their evasion, and measures AI-driven evasion against real IDS configurations. RL-enhanced bots bypass detection at markedly higher rates, but the study also reveals how much the IDS setup itself shifts the balance.

Read the full paper (PDF) →

Cite this paper (BibTeX)
@inproceedings{khamaisi2025-moving-target-offense,
  author    = {Karim Khamaisi and Anton Crazzolara and Aleksandar Ristic and Samuel Brügger and Bruno Rodrigues and Jan von der Assen and Burkhard Stiller},
  title     = {{Moving Target Offense: RL-based Adaptive Evasion Strategies for C2 Frameworks}},
  booktitle = {IEEE Conference on Local Computer Networks (LCN)},
  year      = {2025},
  address   = {Sydney, Australia},
  url       = {https://sensing-group.com/files/papers/2025-lcn-moving-target-offense.pdf}
}