Trends in Circumventing Web-Malware Detection

Moheeb Abu Rajab, Lucas Ballard, Nav Jagpal, Panayiotis Mavrommatis,Daisuke Nojiri, Niels Provos, Ludwig Schmidt

Present by Li Xu

Detecting Malicious Web Sites

Which pages are safe URLs for

end users?

• Safe URL?• Web exploit?• Spam-advertised site?• Phishing site?

URL = Uniform Resource Locator

http://www.bfuduuioo1fp.mobi/ws/ebayisapi.dll

http://fblight.com

http://mail.ru

http://www.sigkdd.org/kdd2009/index.html

This page is reference to Justin Ma’s slides

Problem in a Nutshell

Different classes of URLs Benign, spam, phishing, exploits, scams... For now, distinguish benign vs. malicious

facebook.com fblight.com

This page is reference to Justin Ma’s slides

State of the Practice

Current approaches– Virtual Machine Honeypots.– Browser Emulation.– Reputation Based Detection.– Signature Based Detection.

Arms race

How does adversaries respond & what techniques have been

used to bypass detection.

Google System

Data Collection

Data Set I, is the data that is generated by ouroperational pipeline, i.e., the output of PageScorer. It was generated by processing 1.6 billion distinct web ∼pages collected be-tween December 1, 2006 and April 1, 2011.

Data Set II,sample pages from data set I suspicious1% of other “non- suspicious” pages uniformly at random from the same time period. rescore the original HTTP responses a fixed version of PageScorer

Attacks on client honeypot

Exploits encountered on the web

Javascript funtion calls

DOM fuctions

Malware distribution chain length

Cloaking sites & 2 methods comparation

2 methods comparation

Social Engineering is growing and poses challenges to VM-based honeypots

JavaScript obfuscation that interacts heavily with the DOM can be used to evade both Browser Emulators and AV engines.

AV Engines also suffer significantly from both false positives and false negatives.

Finally, we see a rise in IP cloaking to thwart content-based detection schemes

Summary

As our analysis is based on sites rather than individual web pages, we compute theaverage value for sites on which we encounter multiple web pages in a given month.

Granularity

Thank YouLI XU

Trends in Circumventing Web-Malware Detection

Documents

Intrusion Detection and Malware Analysis - Malware collection

Detection of ASCII Malware

Graph Techniques for Malware Detection

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Behavior-Based Malware Detection

Malware detection with OSSEC @santiagobassett. Setting up a malware lab Collection Analysis Detection @santiagobassett

Malware Classification And Detection

Detection of APT Malware through External and … of APT Malware through External and Internal Network Tra c ... ’Detection of APT Malware through External and ... 1.3.1 Detection

Drivesploit: Circumventing Both Automated AND Manual Drive-By-Download Detection

On detection methods and analysis of malware › ~async › CCIS › talk_12 › VirusDetectionMethods.pdfOn detection methods and analysis of malware 1. A quick tour of Malware detection

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Script-based malware detection in Online Banking · PDF file · 2015-06-08Script-based malware detection in online banking – security overview ... Script-based malware detection

Skeleton key malware detection owasp

Malware detection

Towards Stealthy Malware Detection 1

Automating Malware Detection by Inferring Intent · Automating Malware Detection by Inferring Intent Weidong Cui ... Automating Malware Detection by Inferring Intent by Weidong Cui

Malware- Types, Detection and Future

Analyzing Malware Detection Effectiveness with Multiple Anti-Malware Programs

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE