DECANTeR

Abstract

We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype with realistic data from an international organization and datasets composed of malicious traffic. We show that our system achieves a false positive rate of 0.9% for 441 monitored host machines, an average detection rate of 97.7%, and that it cannot be evaded by malware using simple evasion techniques such as using known browser user agent values. We compare our solution with DUMONT [24], the current state-of-the-art IDS which detects HTTP covert communication channels by focusing on benign HTTP traffic. The results show that DECANTeR outperforms DUMONT in terms of detection rate, false positive rate, and even evasion-resistance. Finally, DECANTeR detects 96.8% of information stealers in our dataset, which shows its potential to detect data exfiltration.

Accurate DNS server fingerprinting based on borderline behavior analysis

“…Li [15] performed a large-scale measurement for millions of fingerprints to figure out fingerprint dynamics in a real-world website and they found that state-of-the-art fingerprinting tools performs poorly in real-world setting. Bortolameotti et al [16] propose a detection framework of anomalous outbound HTTP traffic by passive application fingerprinting. They focus on different cases like background applications and browser applications to detect anomalous communications.…”

Hfinger: Malware HTTP Request Fingerprinting

“…Fingerprinting of HTTP network traffic can be used to create models of applications present in a monitored network and used as a baseline for detecting unknown applications that can be malicious. Bortolameotti et al presented in [7] DECANTeR a system for detection of HTTP network traffic that is anomalous for analyzed host. It passively extracts fingerprints of benign applications running on the host.…”

How are your Apps Doing? QoE Inference and Analysis in Mobile Devices

“…Relying on TCP stream based statistical features, Petagna et al [25] demonstrate that it is possible to accurately identify apps in traffic anonymized through Tor, and that web browsers play thereby a crucial role as traffic patterns differentiate strongly between browser versions. Finally, the authors of [26] have proposed DECANTeR, which builds real-time fingerprints from desktop apps exploiting the headers of the HTTP messages.…”