On the analysis of the Zeus botnet crimeware toolkit

Binsalleeh, Hamad; Ormerod, Thomas C.; Boukhtouta, Amine; Sinha, Prosenjit; Youssef, Amr M.; Debbabi, Mourad; Wang, L.

doi:10.1109/pst.2010.5593240

Cited by 152 publications

(107 citation statements)

References 5 publications

Supporting

Mentioning

103

Contrasting

Unclassified

Order By: Relevance

“…Under normal operation (i.e. with no malware injected) 6 all of the feature vectors are combined into a training dataset for the one-class SVM formulation. Conversely, under detection conditions each newly monitored and post-processed feature vector is tested against the training data in order to determine whether it is anomalous or normal.…”

Section: Cloud Resilience Architecturementioning

confidence: 99%

“…The Kelihos malware was first detected in 2010 and has since been developed into new variants that perform a range of attacks such as phishing and spamming [5]. Zeus was first detected in 2010 [6], but since then there has been a plethora of new variants that even recently (July 2014) compromised millions of machines and gave rise to a botnet that could steal sensitive banking information [7].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Malware Detection in Cloud Computing Infrastructures

Watson

Shirazi

Marnerides

et al. 2016

IEEE Trans. Dependable and Secure Comput.

142

View full text Add to dashboard Cite

Abstract-Cloud services are prominent within the private, public and commercial domains. Many of these services are expected to be always on and have a critical nature; therefore, security and resilience are increasingly important aspects. In order to remain resilient, a cloud needs to possess the ability to react not only to known threats, but also to new challenges that target cloud infrastructures. In this paper we introduce and discuss an online cloud anomaly detection approach, comprising dedicated detection components of our cloud resilience architecture. More specifically, we exhibit the applicability of novelty detection under the one-class support Vector Machine (SVM) formulation at the hypervisor level, through the utilisation of features gathered at the system and network levels of a cloud node. We demonstrate that our scheme can reach a high detection accuracy of over 90% whilst detecting various types of malware and DoS attacks. Furthermore, we evaluate the merits of considering not only system-level data, but also network-level data depending on the attack type. Finally, the paper shows that our approach to detection using dedicated monitoring components per VM is particularly applicable to cloud scenarios and leads to a flexible detection system capable of detecting new malware strains with no prior knowledge of their functionality or their underlying instructions.Index Terms-Security, resilience, invasive software, multi-agent systems, network-level security and protection.

show abstract

Section: Cloud Resilience Architecturementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Malware Detection in Cloud Computing Infrastructures

Watson

Shirazi

Marnerides

et al. 2016

IEEE Trans. Dependable and Secure Comput.

142

View full text Add to dashboard Cite

show abstract

“…The first Zeus malware instant was detected in 2010 [14] but since then there is a plethora of new variants that even recently (July 2014) compromised millions of machines and enabled a botnet that could steal sensitive banking information [13].…”

Section: A Data Measurementsmentioning

confidence: 99%

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Marnerides

Spachos

Chatzimisios

et al. 2015

2015 International Conference on Computing, Networking and Communications (ICNC)

View full text Add to dashboard Cite

Abstract-Cloud networks underpin most of todays' socioeconomical Information Communication Technology (ICT) environments due to their intrinsic capabilities such as elasticity and service transparency. Undoubtedly, this increased dependence of numerous always-on services with the cloud is also subject to a number of security threats. An emerging critical aspect is related with the adequate identification and detection of malware.In the majority of cases, malware is the first building block for larger security threats such as distributed denial of service attacks (e.g. DDoS); thus its immediate detection is of crucial importance. In this paper we introduce a malware detection technique based on Ensemble Empirical Mode Decomposition (E-EMD) which is performed on the hypervisor level and jointly considers system and network information from every Virtual Machine (VM). Under two pragmatic cloud-specific scenarios instrumented in our controlled experimental testbed we show that our proposed technique can reach detection accuracy rates over 90% for a range of malware samples. In parallel we demonstrate the superiority of the introduced approach after comparison with a covariance-based anomaly detection technique that has been broadly used in previous studies. Consequently, we argue that our presented scheme provides a promising foundation towards the efficient detection of malware in modern virtualized cloud environments.

show abstract

“…Due to their intrinsic characteristics of reliability and robustness, P2P based networks are often used as botnet architectures, since it is particularly difficult to detect and dismantling them [18]- [20]. For instance, the Phatbot botnet adopts a P2P based communication system that makes use of the WASTE protocol [21] and connects the agents using a Gnutella caching server [22].…”

Section: B P2p Based Modelsmentioning

confidence: 99%

Mobile Botnets Development: Issues and Solutions

Farina¹,

Cambiaso²,

Papaleo³

et al. 2014

IJFCC

View full text Add to dashboard Cite

Abstract-Due to their limited capabilities, mobile devices have rarely been adopted as attack vectors. In this paper, we consider the execution of coordinated and distributed attacks perpetrated by mobile devices (mobile botnet). We first describe current botnets architectures, analyzing their strengths and weaknesses. Then, we identify problems deriving from the development of a mobile botnet. Appropriate solutions to such problems have been proposed, thus providing an important resource during design and development stages of a mobile botnet. ⎯ Index Terms-Distributed attacks, network attacks, network security, system architecture, smartphones, denial of service.

show abstract

On the analysis of the Zeus botnet crimeware toolkit

Cited by 152 publications

References 5 publications

Malware Detection in Cloud Computing Infrastructures

Malware Detection in Cloud Computing Infrastructures

Malware detection in the cloud under Ensemble Empirical Mode Decomposition

Mobile Botnets Development: Issues and Solutions

Contact Info

Product

Resources

About