LSTM RNN: detecting exploit kits using redirection chain sequences

Abstract

While consumers use the web to perform routine activities, they are under the constant threat of attack from malicious websites. Even when visiting ‘trusted’ sites, there is always a risk that site is compromised, and, hosting a malicious script. In this scenario, the injected script would typically force the victim’s browser to undergo a series of redirects before reaching an attacker-controlled domain, which, delivers the actual malware. Although these malicious redirection chains aim to frustrate detection and analysis efforts, they could be used to help identify web-based attacks. Building upon previous work, this paper presents the first known application of a Long Short-Term Memory (LSTM) network to detect Exploit Kit (EK) traffic, utilising the structure of HTTP redirects. Samples are processed as sequences, where each timestep represents a redirect and contains a unique combination of 48 features. The experiment is conducted using a ground-truth dataset of 1279 EK and 5910 benign redirection chains. Hyper-parameters are tuned via K-fold cross-validation (5f-CV), with the optimal configuration achieving an F1 score of 0.9878 against the unseen test set. Furthermore, we compare the results of isolated feature categories to assess their importance.

EKnad: Exploit Kits’ network activity detection

“…• A4: The ML based detection system must be evaluated using more than one classifier. Although this may seem evident, there are some works for EK detection such as [14] that consider only one classification algorithm to obtain results. • A5: Benign and malware samples should not correspond to different time periods [50].…”

“…At the time of writing this work, a new EK has emerged named Purple Fox that includes several 1-day exploits such as CVE-2021-26411 and CVE-2020-0674 [10]. The research community has been also active in this area (as we analyze in Section 3), while the latest works (i.e., published in 2020 & 2021) analyze EKs from various point of views including browser forensics, detection methodologies, and the role of underground economy in the continuous development of EKs [11], [12], [13], [14], [15]. Overall, we argue that the problem of EKs still poses a viable threat to both individuals and organizations.…”

“…The authors' main goal was to generate HTTP redirection features and not to propose a fullfledged EK detection solution. In their newer work, Burgess et al [14] deployed the 1279 EK and 5910 benign redirection chains that were identified in [28] to detect EKs using an LSTM RNN classifier. The classifier attained 0.9878 F1-Score using only redirection features.…”

Insights into Search Engine Optimization using Natural Language Processing and Machine Learning

“…A clustering approach based on extracted features from contextual information is implemented in this process. The work carried out by Burgess et al [36] address the problems associated with security of web-contents, which is another essential concern in SEO process. The authors have used Long Short-Term Memory (LSTM) for identifying the possible threat in traffic associated with web-content while making redirection in HTTP.…”

Intelligent Modeling of the Incineration Process in Waste Incineration Power Plant Based on Deep Learning

“…First, use the input x t at the present moment and the external condition h t−1 at the previous moment to calculate f t , i t , o t and c t . Secondly, use f t and i t to update the memory unit c t , and finally, pass the internal state information to the external state h t in combination with o t [23].…”