Automated Link Tracing for Classification of Malicious Websites in Malware Distribution Networks
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
Malicious code distribution on the Internet is one of the most critical Internet-based threats and distributiontechnology has evolved to bypass detection systems. As a new defense against the detection bypass technologyof malicious attackers, this study proposes the automated tracing of malicious websites in a malwaredistribution network (MDN). The proposed technology extracts automated links and classifies websites intomalicious and normal websites based on link structure. Even if attackers use a new distribution technology,website classification is possible as long as the connections are established through automated links. The use ofa real web-browser and proxy server enables an adequate response to attackers’ perception of analysisenvironments and evasion technology and prevents analysis environments from being infected by maliciouscode. The validity and accuracy of the proposed method for classification are verified using 20,000 links, 10,000each from normal and malicious websites.
Abstract
Malicious code distribution on the Internet is one of the most critical Internet-based threats and distributiontechnology has evolved to bypass detection systems. As a new defense against the detection bypass technologyof malicious attackers, this study proposes the automated tracing of malicious websites in a malwaredistribution network (MDN). The proposed technology extracts automated links and classifies websites intomalicious and normal websites based on link structure. Even if attackers use a new distribution technology,website classification is possible as long as the connections are established through automated links. The use ofa real web-browser and proxy server enables an adequate response to attackers’ perception of analysisenvironments and evasion technology and prevents analysis environments from being infected by maliciouscode. The validity and accuracy of the proposed method for classification are verified using 20,000 links, 10,000each from normal and malicious websites.
참고문헌 (24)
- European Union Agency for Network and Information Security, "ENSIA Threats Landscape 2014", European Union Agency for Network and Information Security, ~ (2015)
- "Department of Labor website hacked to distribute malware" (2013)[URL]
- "NBC hack infects visitors in ‘drive by’ cyberattack" (2013)[URL]
- N. Provos, "All your iFRAMEs point to us", Proceedings of the USENIX Security Symposium, pp.1~16 (2008)
- K. Z. Chen, "WebPatrol: automated collection and replay of webbased malware scenarios", Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp.186~195 (2011)
- J. Ma, "Identifying suspicious URLs: an application of large-scale online learning", Proceedings of the 26th Annual International Conference on Machine Learning, pp.681~688 (2009)
- J. Ma, "Beyond blacklists: learning to detect malicious web sites from suspicious URLs", Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.1245~1254 (2009)
- Y. Shindo, "Lightweight approach to detect drive-by download attacks based on file type transition", Proceedings of the 2014 CoNEXT on Student Workshop, pp.28~30 (2014)
- G. Wang, "Detecting malicious landing pages in malware distribution networks", Proceedings of 2013 43rd Annual IEEE, 2013, 1~11
- G. Stringhini, "Shady paths: leveraging surfing crowds to detect malicious web pages", Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, pp.133~144 (2013)
- A. Moshchuk, "SpyProxy: execution-based detection of malicious web content", Proceedings of the USENIX Security Symposium, pp.1~16 (2007)
- M. Cova, "Detection and analysis of drive-by-download attacks and malicious JavaScript code", Proceedings of the 19th International Conference on, pp.281~290 (2010)
- M. Akiyama, "Design and implementation of high interaction client honeypot for drive-by-download attacks", IEICE Transactions on Communications, 93(5), pp.1131~1139 (2010)
- "Cuckoo Sandbox"[URL]
- "The International Secure Systems Lab (iSecLab)"[URL]
- M. Egele, "A survey on automated dynamic malware-analysis techniques and tools", ACM Computing Surveys, 44(2) (2012)
- K. Mathur, "A survey on techniques in detection and analyzing malware executables", International Journal of Advanced Research in Computer Science and Software Engineering, 3(4), pp.422~428 (2013)
- B. I. Kim, "Suspicious malicious web site detection with strength analysis of a Javascript obfuscation", International Journal of Advanced Science and Technology, 26, pp.19~32 (2011)
- N. Provos, "The ghost in the browser: analysis of web-based malware", Proceedings of the 1st Workshop on Hot Topics in Understanding Botnets (HotBots) (2007)
- 최상용, "ELPA: Emulation-Based Linked Page Map Analysis for the Detection of Drive-by Download Attacks", JIPS(Journal of Information Processing Systems), 12(3), pp.422~435 (2016), 한국정보처리학회
- L. Invernizzi, "Nazca: detecting malware distribution in large-scale networks", Proceedings of the 2014 Network and Distributed System Security (NDSS) Symposium, pp.23~26 (2014)
- S. Carolin Jeeva, "Intelligent phishing url detection using association rule mining", Human-centric Computing and Information Sciences, 6(1) (2016), Springer Science and Business Media LLC[DOI]
- "Mitmproxy"[URL]
- "SecureSurf"[URL]