detecting the behavioral relationships of malware
play

Detecting the behavioral relationships of malware connections - PDF document

Nov 07, 2023 •195 likes •380 views

See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/307638742 Detecting the behavioral relationships of malware connections (slides) Conference Paper August 2016 CITATIONS READS 0

  1. See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/307638742 Detecting the behavioral relationships of malware connections (slides) Conference Paper · August 2016 CITATIONS READS 0 149 2 authors , including: Sebastián García Czech Technical University in Prague 55 PUBLICATIONS 562 CITATIONS SEE PROFILE Some of the authors of this publication are also working on these related projects: Stratosphere Project View project A Study of RATs View project All content following this page was uploaded by Sebastián García on 06 September 2016. The user has requested enhancement of the downloaded file.

  2. Detecting the Behavioral Relationships of Malware Connections (positional paper) Sebastian Garcia & Michal Pechoucek sebastian.garcia@agents.fel.cvut.cz @eldracote Live: bit.ly/praise2016

  3. The origin Privacy and surveillance. The MasterMind program. We should know how to deal with this, and use it. Behavior of malware, how to detect it.

  4. The Problem False positives: You detect malicious when is not. Detection of what? Packets? Flows? Web logs? Unique computers? Differentiating normal from malicious ​ We may detect malicious alone. But when it is mixed with normal, it's far more difficult.

  5. Stratosphere IPS Project Model network behaviors as a string of letters . 1 flow 3 features 1 letter 1 connection (srcIP, dstIP, dstPort, Proto) String

  6. The Problem of Stratosphere Usually working, but some behaviors are very similar . Normal Radio Streaming 88,h,h,h,h,h,h,H,H,h,h,h,h,H,H,h,H,H,h,H,h,H,H,H,h, Botnet C&C server 23.247.5.27 port 25000/tcp 88,H,H,h,H,H,h,h,h,h,h,H,h,H,H,H https://stratosphereips.org

  7. A better differentiation We are looking too closely. Analyze the behavior of the Host, instead of a connection.

  8. A New type of Graph A graph to show the relationships of flow sequences . Made by Daniel Š molík , from the Stratosphere team. A graph per client (source IP). A node is the combination of dst IP, dst port, protocol . An edge is a flow sequence as seen in the network. The more times the edge is found, the thicker. The more times the node is repeated, the larger. The more times the node looped, the color changes.

  9. Normal Graph 1 client

  10. Normal Graph Same 1 client, not DNS servers.

  11. Geodo Botnet complete graph

  12. Geodo Botnet filtered graph No DNS, icmp, ipv6, arp or multicast.

  13. Mixed Normal and Adware Before Infection. No DNS

  14. Mixed Normal and Adware After Infection. No DNS

  15. Mixed Normal and Adware After Infection. No DNS

  16. Analyzing the Behavior of a Host Now Amount of times a [dst ip, dst port and protocol] is accessed (node). Amount of times a node comes after other node in sequence (edge). Amount of times a node loops with itself. Work in progress Loops Find loops in the graph structure. Complex loops, double loops (Geodo). Type of nodes. Type of nodes connecting to each node (relation). Stratosphere Behaviors

  17. Conclusion and Thanks! The behavior of a host may be modeled looking at its actions, relationships and loops. These are the differentiable features of malware. More experiments, evaluation and comparison. Thank you for staying! And thanks Daniel Smolík for his work. Sebastian Garcia sebastian.garcia@agents.fel.cvut.cz @eldracot e View publication stats View publication stats

Recommend

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico Mariconti , Lucky Onwuzurike, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon Ross, Gianluca Stringhini. NDSS 2017, 28-02-2017 Motivation: Android

1.21k views • 37 slides
StormDroid: A streaminglized Machine Learning-Based System for Detecting Android Malware Sen

StormDroid: A streaminglized Machine Learning-Based System for Detecting Android Malware Sen

StormDroid: A streaminglized Machine Learning-Based System for Detecting Android Malware Sen Chen, Minhui Xue, Zhushou Tang, Lihua Xu, Haojin Zhu Malware Detection in Android 1.6 million apps in Google Play Store in July 2015

441 views • 22 slides
Behavioral Detection and Containment of Proximity Malware in Delay Tolerant Networks Wei Peng,

Behavioral Detection and Containment of Proximity Malware in Delay Tolerant Networks Wei Peng,

Behavioral Detection and Containment of Proximity Malware in Delay Tolerant Networks Wei Peng, Feng Li, Xukai Zou, and Jie Wu 1 / 47 Proximity malware Definition. Proximity malware is a malicious program which propagates

618 views • 47 slides
Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci (1,2) , Wenke Lee (1,2) , Nick Feamster (1) (1) (2) USENIX NSDI 2010 Malware = Malicious Software Most modern cyber

601 views • 31 slides
Procopiou Anna 931769 Professor: Dr. Athanasopoulos Elias 1 Articles 1. Detecting Malware

Procopiou Anna 931769 Professor: Dr. Athanasopoulos Elias 1 Articles 1. Detecting Malware

Procopiou Anna 931769 Professor: Dr. Athanasopoulos Elias 1 Articles 1. Detecting Malware Domains at the Upper DNS Hierarchy -M.Antonakakis et. al 2. ZMap: Fast Internet-wide Scanning and Its Security Applications -Z. Durumeric et. al 2

1.17k views • 89 slides
Malware Behavioral Detection by Attribute-Automata using Abstraction from Platform and Language

Malware Behavioral Detection by Attribute-Automata using Abstraction from Platform and Language

Malware Behavioral Detection by Attribute-Automata using Abstraction from Platform and Language JACOB Grgoire 1/2 , DEBAR Herv 1 , FILIOL Eric 2 1 Orange Labs / France Tlcom R&D, Security and Trusted Transactions (MAPS/STT). 2

327 views • 21 slides
Detecting Self-Mutating Malware Using Control-Flow Graph Matching Danilo Bruschi Lorenzo

Detecting Self-Mutating Malware Using Control-Flow Graph Matching Danilo Bruschi Lorenzo

Detecting Self-Mutating Malware Using Control-Flow Graph Matching Danilo Bruschi Lorenzo Martignoni Mattia Monga Dipartimento di Informatica e Comunicazione Universit` a degli Studi di Milano { bruschi,martign,monga } @dico.unimi.it

356 views • 23 slides
WEBCOP: LOCATING NEIGHBORHOODS OF MALWARE ON THE WEB Reid Andersen Jay Stokes

WEBCOP: LOCATING NEIGHBORHOODS OF MALWARE ON THE WEB Reid Andersen Jay Stokes

WEBCOP: LOCATING NEIGHBORHOODS OF MALWARE ON THE WEB Reid Andersen Jay Stokes Christian Seifert Microsoft Research Kumar Chellapilla Microsoft Search Detecting Malicious Web Pages Detecting Malicious Web Pages Production

427 views • 23 slides
Malware Collusions Karim O. Elish, Danfeng (Daphne) Yao, and Barbara G. Ryder Department of

Malware Collusions Karim O. Elish, Danfeng (Daphne) Yao, and Barbara G. Ryder Department of

On the Need of Precise Inter-App ICC Classification for Detecting Android Malware Collusions Karim O. Elish, Danfeng (Daphne) Yao, and Barbara G. Ryder Department of Computer Science Virginia Tech May 21, 2015 Problem and Motivation Malware

139 views • 13 slides
Detecting DGA malware using NetFlow Martin Grill , Ivan Nikolaev , Veronica Valeros

Detecting DGA malware using NetFlow Martin Grill , Ivan Nikolaev , Veronica Valeros

Detecting DGA malware using NetFlow Martin Grill , Ivan Nikolaev , Veronica Valeros , Martin Rehak Cisco Systems, Inc. magrill@cisco.com, inikolae@cisco.com, vvaleros@cisco.com, marrehak@cisco.com Faculty of

606 views • 6 slides
A framework for modeling the relationships between the rational and behavioral reactions of

A framework for modeling the relationships between the rational and behavioral reactions of

A framework for modeling the relationships between the rational and behavioral reactions of assisting conversational agents Franois Bouchet Jean-Paul Sansonnet LIMSI-CNRS Universit Paris-Sud XI December 18th 2009 EUMAS 2009 Introduction

789 views • 33 slides
Detecting Environment-Sensitive Malware Martina Lindorfer Vienna University of Technology

Detecting Environment-Sensitive Malware Martina Lindorfer Vienna University of Technology

Int. Secure Systems Lab Vienna University of Technology Detecting Environment-Sensitive Malware Martina Lindorfer Vienna University of Technology Clemens Kolbitsch Paolo Milani Comparetti 1 Motivation Int. Secure Systems Lab Vienna

381 views • 25 slides
Mining malware specifications through static reachability analysis Hugo Daniel Macedo 1 Tayssir

Mining malware specifications through static reachability analysis Hugo Daniel Macedo 1 Tayssir

Introduction Mining specifications Detecting malware Results References Mining malware specifications through static reachability analysis Hugo Daniel Macedo 1 Tayssir Touili 2 1 INRIA Rocqencourt 2 LIAFA Univ. Paris 7 November 4, 2013

870 views • 45 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
12/6/2013 Detecting Fakes Image Forensics: Detecting Forged Photos 1.Detecting photorealistic

12/6/2013 Detecting Fakes Image Forensics: Detecting Forged Photos 1.Detecting photorealistic

12/6/2013 Detecting Fakes Image Forensics: Detecting Forged Photos 1.Detecting photorealistic graphics 2.Detecting manipulated images Photo manipulation is the application of image editing techniques to photographs in order to create an

306 views • 13 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:> whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (over 11 years!) Focus & Interests: Malware Analysis, Threat Intel,

1.45k views • 115 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides

More recommend