MalPEFinder: fast and retrospective assessment of data breaches in malware attacks

Abstract

A successful data breach is often caused by malware installed by attackers. In a large-scale computer environment, it is difficult and costly for information technology managers to identify the victims and to assess the scope of the data breach when a malware attack occurs. Therefore, a quick and retrospective mechanism that can find victims is required. One such technology is Search. However, most search techniques are not designed for searching executable files; indeed, they become worse in identifying malware files because of polymorphism and/or metamorphism.In this paper, we propose a portable executable format file search mechanism, called MalPEFinder. Instead of searching malware files, this mechanism searches the malware-related files retrospectively. Based on these files and their ownership, MalPEFinder can locate malware files on a large scale quickly. Furthermore, the possibly breached files also can be identified. A MalPEFinder prototype has been implemented on the HADOOP platform in order to perform three functions: (i) searching retrospectively; (ii) protecting evidence against tampering; and (iii) dealing with future data growth. We used 72 malware to evaluate the accuracy and efficiency of our system. The experimental results show that MalPEFinder has a higher detection rate as well as a lower false positive rate than the famous SPLUNK tool.

Extrusion detection of illegal files in cloud-based systems

“…Schaefer et al (2012) and Edmundson and Schaefer (2013) propose an approach for the retrieval of multimedia files from Huffman tables located in the header of JPEG files. Shabtai et al (2011) present eDare and Liu and Chen (2012) posit MalPEFinder to detect malware by searching for executable files. These schemes have in common three issues that restrict their use in the identification of files in cloud-based systems.…”