Adaptive Detection of Covert Communication in HTTP Requests

Schwenk, Guido; Rieck, Konrad

doi:10.1109/ec2nd.2011.12

Cited by 12 publications

(22 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Denying or restricting network access is often used to thwart malware (using firewalls to block outside connections to sensitive networks is a commonly means of accomplishing this). To bypass such protection mechanisms, the malware might employ any combination of the following network evasion techniques [45]:…”

Section: Avoiding Detectionmentioning

confidence: 99%

Dynamic Malware Analysis in the Modern Era—A State of the Art Survey

et al. 2019

View full text Add to dashboard Cite

ORI OR-MEIR, NIR NISSIM, YUVAL ELOVICI, and LIOR ROKACH, Ben-Gurion University of the Negev, Beer-Sheva, IsraelAlthough malicious software (malware) has been around since the early days of computers, the sophistication and innovation of malware has increased over the years. In particular, the latest crop of ransomware has drawn attention to the dangers of malicious software, which can cause harm to private users as well as corporations, public services (hospitals and transportation systems), governments, and security institutions. To protect these institutions and the public from malware attacks, malicious activity must be detected as early as possible, preferably before it conducts its harmful acts. However, it is not always easy to know what to look for-especially when dealing with new and unknown malware that has never been seen. Analyzing a suspicious file by static or dynamic analysis methods can provide relevant and valuable information regarding a file's impact on the hosting system and help determine whether the file is malicious or not, based on the method's predefined rules. While various techniques (e.g., code obfuscation, dynamic code loading, encryption, and packing) can be used by malware writers to evade static analysis (including signature-based antivirus tools), dynamic analysis is robust to these techniques and can provide greater understanding regarding the analyzed file and consequently can lead to better detection capabilities. Although dynamic analysis is more robust than static analysis, existing dynamic analysis tools and techniques are imperfect, and there is no single tool that can cover all aspects of malware behavior. The most recent comprehensive survey performed in this area was published in 2012. Since that time, the computing environment has changed dramatically with new types of malware (ransomware, cryptominers), new analysis methods (volatile memory forensics, side-channel analysis), new computing environments (cloud computing, IoT devices), new machine-learning algorithms, and more. The goal of this survey is to provide a comprehensive and up-to-date overview of existing methods used to dynamically analyze malware, which includes a description of each method, its strengths and weaknesses, and its resilience against malware evasion techniques. In addition, we include an overview of prominent studies presenting the usage of machine-learning methods to enhance dynamic malware analysis capabilities aimed at detection, classification, and categorization.

show abstract

Section: Avoiding Detectionmentioning

confidence: 99%

Dynamic Malware Analysis in the Modern Era—A State of the Art Survey

et al. 2019

View full text Add to dashboard Cite

show abstract

“…MONT [24] in Python, the current state of the art regarding host-specific anomaly detection. We have evaluated and compared them with different datasets.…”

Section: • We Have Implemented Prototypes Of Decanter and Du-mentioning

confidence: 99%

“…For instance, data exfiltration can be an obfuscated transmission of a database in small chunks within hours, or a cryptographic key pair within a single request. To tackle these issues, researchers have proposed anomaly-based detection approaches that generate models only from the benign network data of each specific machine [5,24]. We refer to this category as host-specific anomaly detection, which differs from the commonly known term 'host-based' used for techniques that analyze the internal state of a machine.…”

Section: Introductionmentioning

confidence: 99%

“…Therefore, if malware runs on the host it may generate new fingerprints that show different patterns from those representing host applications. We have evaluated DECANTeR with different datasets-one of which contained traffic of an international organization-and we have compared the results with the current state of the art solution DUMONT [24], showing a clear improvement in the detection performance.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

DECANTeR

Bortolameotti

Ede

Caselli

et al. 2017

Proceedings of the 33rd Annual Computer Security Applications Conference

View full text Add to dashboard Cite

We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype with realistic data from an international organization and datasets composed of malicious traffic. We show that our system achieves a false positive rate of 0.9% for 441 monitored host machines, an average detection rate of 97.7%, and that it cannot be evaded by malware using simple evasion techniques such as using known browser user agent values. We compare our solution with DUMONT [24], the current state-of-the-art IDS which detects HTTP covert communication channels by focusing on benign HTTP traffic. The results show that DECANTeR outperforms DUMONT in terms of detection rate, false positive rate, and even evasion-resistance. Finally, DECANTeR detects 96.8% of information stealers in our dataset, which shows its potential to detect data exfiltration.

show abstract

“…The first observation suggests that monitoring any single part of the attack chain will be insufficient to reliably identify attacks. For instance, network connections corresponding C&C channel will often be highly active and long‐lasting, which has prompted the construction of C&C detectors . The problem is that many legitimate connections exhibit similar patterns, leading to an inevitable high false alarm rate.…”

Section: Introductionmentioning

confidence: 99%

Attack chain detection

Sexton

Storlie

Neil

2015

Statistical Analysis

View full text Add to dashboard Cite

A targeted network intrusion typically evolves through multiple phases, termed the attack chain. When appropriate data are monitored, these phases will generate multiple events across the attack chain on a compromised host. It is shown empirically that events in different parts of the attack chain are largely independent under nonattack conditions. This suggests that a powerful detector can be constructed by combining across events spanning the attack. This article describes the development of such a detector for a larger network. To construct events that span the attack chain, multiple data sources are used, and the detector combines across events observed on the same machine, across local neighborhoods of machines linked by network communications, as well as across events observed on multiple computers. A probabilistic approach for evaluating the combined events is developed, and empirical investigations support the underlying assumptions. The detection power of the approach is studied by inserting plausible attack scenarios into observed network and host data, and an application to a real-world intrusion is given. Published 2015. This article is a U.S. Government work and is in the public domain in the USA. Statistical Analysis and Data Mining:

show abstract

Adaptive Detection of Covert Communication in HTTP Requests

Cited by 12 publications

References 11 publications

Dynamic Malware Analysis in the Modern Era—A State of the Art Survey

Dynamic Malware Analysis in the Modern Era—A State of the Art Survey

DECANTeR

Attack chain detection

Contact Info

Product

Resources

About