Network Forensics: Detection and Mitigation of Botnet Malicious Code via Darknet

Azrina, R.; Othman, Roslina; Aziz, Normaziah Abdul; ZulHazmi, M.; Khazin, M.; Dewakunjari, J.

doi:10.2991/978-94-91216-71-8_4

Cited by 2 publications

(2 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors of Ref. [13] demonstrated darknet monitoring in LAN. Unused IP addresses in their campus networks were defined as darknet.…”

Section: Darknet-monitoring-based Malware Detection On Lanmentioning

confidence: 99%

“…The authors of Ref. [13] reported that darknet monitoring in LAN is effective for identifying the infected hosts, i.e., detecting malware, which can be found in Section 2.2 in detail. We believe that darknet-monitoring-based malware detection in LAN of ICS is effective compared to general networks and the Internet since normal communications on ICS networks are static compared to general networks.…”

Section: Introduction 11 Background and Motivationmentioning

confidence: 99%

See 1 more Smart Citation

Novel Deception Techniques for Malware Detection on Industrial Control Systems

Machida

Yamamoto

Unno

et al. 2021

Journal of Information Processing

View full text Add to dashboard Cite

To maintain the availability of industrial control systems (ICS), it is important to robustly detect malware infection that spreads within the ICS network. In ICS, a host often communicates with the determined hosts; for instance, a supervisory control host observes and controls the same devices routinely via the network. Therefore, a communication request to the unused internet protocol (IP) address space, i.e., darknet, in the ICS network is likely to be caused by malware in the compromised host in the network. That is, darknet monitoring may enable us to detect malware that tries to spread indiscriminately within the network. On the other hand, clever malware, such as malware determining target hosts of infection with reference to host lists in the networks, infects the confined hosts in the networks, and consequently evades detection by security sensors or honeypots. In this paper, we propose novel deception techniques that lure such malware to our sensor, by embedding the sensor information continuously in the lists of hosts in the ICS networks. In addition, the feasibility of the proposed deception techniques is shown through our simplified implementation by using actual malware samples: WannaCry and Conficker.

show abstract

“…The authors of Ref. [13] demonstrated darknet monitoring in LAN. Unused IP addresses in their campus networks were defined as darknet.…”

Section: Darknet-monitoring-based Malware Detection On Lanmentioning

confidence: 99%

Section: Introduction 11 Background and Motivationmentioning

confidence: 99%