ELPA: Emulation-Based Linked Page Map Analysis for the Detection of Drive-by Download Attacks
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
Despite the convenience brought by the advances in web and Internet technology, users are increasingly being exposed to the danger of various types of cyber attacks. In particular, recent studies have shown that today’s cyber attacks usually occur on the web via malware distribution and the stealing of personal information. A drive-by download is a kind of web-based attack for malware distribution. Researchers have proposed various methods for detecting a drive-by download attack effectively. However, existing methods have limitations against recent evasion techniques, including JavaScript obfuscation, hiding, and dynamic code evaluation. In this paper, we propose an emulation-based malicious webpage detection method. Based on our study on the limitations of the existing methods and the state-of-the-art evasion techniques, we will introduce four features that can detect malware distribution networks and we applied them to the proposed method. Our performance evaluation using a URL scan engine provided by VirusTotal shows that the proposed method detects malicious webpages more precisely than existing solutions.
Abstract
Despite the convenience brought by the advances in web and Internet technology, users are increasingly being exposed to the danger of various types of cyber attacks. In particular, recent studies have shown that today’s cyber attacks usually occur on the web via malware distribution and the stealing of personal information. A drive-by download is a kind of web-based attack for malware distribution. Researchers have proposed various methods for detecting a drive-by download attack effectively. However, existing methods have limitations against recent evasion techniques, including JavaScript obfuscation, hiding, and dynamic code evaluation. In this paper, we propose an emulation-based malicious webpage detection method. Based on our study on the limitations of the existing methods and the state-of-the-art evasion techniques, we will introduce four features that can detect malware distribution networks and we applied them to the proposed method. Our performance evaluation using a URL scan engine provided by VirusTotal shows that the proposed method detects malicious webpages more precisely than existing solutions.
참고문헌 (20)
- N. Provos, "The ghost in the browser analysis of web-based malware", Proceedings of the 1st Conference on First Workshop on Hot Topics in Understanding Botnets, pp.1~9 (2007)
- "ENISA Threat Landscape 2012" (2013)[URL]
- "Department of labor website hacked to distribute malware" (2013)[URL]
- "NBC hack infects visitors in 'drive by' cyberattack" (2013)[URL]
- "A first: Hacked sites with Android drive-by download malware" (2012)[URL]
- "Malware analysis report of NateOn hacking" (2012)[URL]
- "DarkSeoul: SophosLabs identifies malware used in South Korean internet attack" (2013)[URL]
- "Malware analysis report using 6.25 DDoS attack" (2013)[URL]
- K. Z. Chen, "WebPatrol: automated collection and replay of web-based malware scenarios", Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp.186~195 (2011)
- J. Ma, "Identifying suspicious URLs: an application of large-scale online learning", Proceedings of the 26th Annual International Conference on Machine Learning, pp.681~688 (2009)
- J. Ma, "Beyond blacklists: learning to detect malicious web sites from suspicious URLs", Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.1245~1254 (2009)
- N. Provos, "All your iFRAMEs point to us", Proceedings of 17th USENIX Security Symposium, pp.1~6 (2008)
- A. Moshchuk, "SpyProxy: execution-based detection of malicious web content", Proceedings of 16th USENIX Security Symposium, pp.1~16 (2007)
- M. Cova, "Detection and analysis of drive-by-download attacks and malicious JavaScript code", Proceedings of the 19th International Conference on World Wide Web, pp.281~290 (2010)
- "ShoVAT: Shodan-based vulnerability assessment tool for Internet-facing services" (2015)[URL]
- B. Genge, "Non-intrusive historical assessment of internet-facing services in the internet of things", MACRo, 1(1), pp.25~36 (2015)
- "VirusTotal"[URL]
- "Understanding of Javascript obfuscation" (2008)[URL]
- 최상용, "악성코드 유포 네트워크 분석을 위한멀티레벨 에뮬레이션", 정보보호학회논문지, 23(6), pp.1121~1129 (2013), 한국정보보호학회[DOI]
- "SpiderMonkey"[URL]