Real-Time Detection System Against Malicious Tools by Monitoring DLL on Client Computers

Matsuda, Wataru; Fujimoto, Mariko; Mitsunaga, Takuho

doi:10.1109/ains47559.2019.8968697

Cited by 12 publications

(24 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To solve the problem shown in Section 2.2, some researchers have introduced detection methods using DLLs loaded by malicious tools [7], [8], [10], [13]. If legitimate Windows DLLs loaded by malicious tools have unique characteristics, the method could detect the tools even if the file names are changed or the tools themselves are rebuilt.…”

Section: Detection Using Dll Loaded By Malicious Toolsmentioning

confidence: 99%

“…If legitimate Windows DLLs loaded by malicious tools have unique characteristics, the method could detect the tools even if the file names are changed or the tools themselves are rebuilt. According to previous research [10], DLLs loaded by malicious tools are dependent on the version of Windows and the malicious tools. We investigated unique DLLs loaded by malicious tools in the evaluation environments (several malicious tools versions * 9 Windows version) based on the research [10].…”

Section: Detection Using Dll Loaded By Malicious Toolsmentioning

confidence: 99%

“…According to previous research [10], DLLs loaded by malicious tools are dependent on the version of Windows and the malicious tools. We investigated unique DLLs loaded by malicious tools in the evaluation environments (several malicious tools versions * 9 Windows version) based on the research [10]. Table 1 shows the number of DLLs that are loaded by each malicious tool.…”

Section: Detection Using Dll Loaded By Malicious Toolsmentioning

confidence: 99%

“…The order in which the DLLs are loaded is not taken into consideration [21]. Matsuda et al propose a detection method of startup of malicious tools by monitoring DLLs that are commonly loaded by malicious tools using the DLL lists [10].…”

Section: Detection In the Running Environmentmentioning

confidence: 99%

“…This research focuses on the detection method in the running environment (computers used in daily works). For the detection method using DLL information in the running environment, a detection method of monitoring DLLs that are commonly loaded by malicious tools using DLL lists [10] has been previously researched. Although, the DLLs loaded by malicious tools are different depending on the version of Windows and the malicious tools.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Detection of Malicious Tools by Monitoring DLL Using Deep Learning

Matsuda

Fujimoto

Mitsunaga

2020

Journal of Information Processing

Self Cite

View full text Add to dashboard Cite

In targeted attacks, various malicious tools are leveraged by attackers. According to the Cybersecurity and Infrastructure Security Agency (CISA), tools such as China Chopper, Mimikatz, PowerShell Empire, and HUC Packet Transmitter are used in targeted attacks. Standard malware detection methods include those based on file names or hashes. However, attackers tend to avoid detection by changing the file name of malicious tools or by rebuilding them. Therefore, detecting malicious tools used in targeted attacks is difficult. We found that the order of Windows built-in DLLs loaded by each malicious tool has unique characteristics. In this study, we propose a detection method of malicious tools by analyzing DLL information using deep learning, considering the DLL and its order of loading by each process. We confirmed that even if the file names are changed or tools are rebuilt, our proposed method could detect the mentioned four tools with high detection rates: with a recall rate of 97.45%, a precision rate of 97.29%, and F value of 97.37% on average. Furthermore, the proposed method can detect malicious tools with more than a 90% detection rate, even if about 10% of loaded DLLs are changed in the future.

show abstract

Section: Detection Using Dll Loaded By Malicious Toolsmentioning

confidence: 99%

Section: Detection Using Dll Loaded By Malicious Toolsmentioning

confidence: 99%