identifying infections with spamming malware in a network
play

Identifying Infections with Spamming Malware in a Network, based on - PowerPoint PPT Presentation

Feb 26, 2024 •9 likes •899 views

Introduction Research Question Background Dataset Approach Results Conclusion Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam

  1. Introduction Research Question Background Dataset Approach Results Conclusion Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam July 2014 Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  2. Introduction Research Question Background Dataset Approach Results Conclusion Acknowledgement Research conducted at Quarantainenet BV, supervised by Casper Joost Eyckelhof Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  3. Introduction Research Question Background Dataset Approach Results Conclusion Outline Introduction Research Question Background DNS MX Dataset Approach Theory Analysis tools Results Frequency Periodicity Entropy Flow Conclusion Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  4. Introduction Research Question Background Dataset Approach Results Conclusion Introduction Spam: Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  5. Introduction Research Question Background Dataset Approach Results Conclusion Introduction Spam: ”Unsolicited means that the Recipient has not granted verifiable permission for the message to be sent. Bulk means that the message is sent as part of a larger collection of messages, all having substantively identical content.” - Spamhaus Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  6. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(2) Spam worldwide problem ◮ Global email: 150-200 billion per day Sources: Symantec and Radicati Group Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  7. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(2) Spam worldwide problem ◮ Global email: 150-200 billion per day ◮ Almost 2/3 is spam Sources: Symantec and Radicati Group Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  8. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(2) Spam worldwide problem ◮ Global email: 150-200 billion per day ◮ Almost 2/3 is spam ◮ Most spam blocked by spamfilters Sources: Symantec and Radicati Group Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  9. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(2) Spam worldwide problem ◮ Global email: 150-200 billion per day ◮ Almost 2/3 is spam ◮ Most spam blocked by spamfilters ◮ Average business user receives 85 emails a day, 10 are spam. Sources: Symantec and Radicati Group Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  10. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(3) ◮ 80% generated by botnet (Symantec) Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  11. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(3) ◮ 80% generated by botnet (Symantec) ◮ Network of infected computers Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  12. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(3) ◮ 80% generated by botnet (Symantec) ◮ Network of infected computers ◮ Owner controlled Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  13. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(3) ◮ 80% generated by botnet (Symantec) ◮ Network of infected computers ◮ Owner controlled ◮ Sold as a service Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  14. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(3) ◮ 80% generated by botnet (Symantec) ◮ Network of infected computers ◮ Owner controlled ◮ Sold as a service ◮ Used for DDoS, Clickfraud, spam Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  15. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(3) ◮ 80% generated by botnet (Symantec) ◮ Network of infected computers ◮ Owner controlled ◮ Sold as a service ◮ Used for DDoS, Clickfraud, spam ◮ Reputation loss, costs for bandwidth, energy Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  16. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(4) Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  17. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(5) What to do? ◮ Prevention Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  18. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(5) What to do? ◮ Prevention ◮ Network monitoring Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  19. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(5) What to do? ◮ Prevention ◮ Network monitoring ◮ Quarantainenet Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  20. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(5) What to do? ◮ Prevention ◮ Network monitoring ◮ Quarantainenet ◮ Different sensors Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  21. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(5) What to do? ◮ Prevention ◮ Network monitoring ◮ Quarantainenet ◮ Different sensors ◮ Accumulate score Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  22. Introduction Research Question Background Dataset Approach Results Conclusion Introduction(5) What to do? ◮ Prevention ◮ Network monitoring ◮ Quarantainenet ◮ Different sensors ◮ Accumulate score ◮ Restrict network acces, put machine in quarantaine Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  23. Introduction Research Question Background Dataset Approach Results Conclusion Research question Research question Is it possible to identify a machine that is in infected with spamming malware by analysing DNS MX requests? Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  24. Introduction Research Question Background Dataset Approach Results Conclusion DNS MX DNS ◮ Domain Name System Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

  25. Introduction Research Question Background Dataset Approach Results Conclusion DNS MX DNS ◮ Domain Name System ◮ Links domain name (google.com) to ip address (74.125.136.138) Bas Vlaszaty Bas.Vlaszaty@os3.nl Universiteit van Amsterdam Identifying Infections with Spamming Malware in a Network, based on Analysis of DNS MX Requests

Recommend

Identifying Infections of the S pine Dr Jamie Wilson FRCS (Neurosurgery) BMBCh.BA(OXON)

Identifying Infections of the S pine Dr Jamie Wilson FRCS (Neurosurgery) BMBCh.BA(OXON)

Identifying Infections of the S pine Dr Jamie Wilson FRCS (Neurosurgery) BMBCh.BA(OXON) Neurosurgery S pine Fellow, Toronto Western Hospital ymposium 2 nd March 2018 S pine Network S The Honest Truth Low Yield: Y ou will investigate

359 views • 25 slides
Outline Malware and the network, contd Denial of service and the network CSci 5271

Outline Malware and the network, contd Denial of service and the network CSci 5271

Outline Malware and the network, contd Denial of service and the network CSci 5271 Introduction to Computer Security Announcements intermission Malware and anonymity combined lecture Anonymous communications techniques Stephen McCamant

665 views • 10 slides
BotGraph: Large Scale Spamming Botnet Detection Web-account abuse attack recent spamming technic

BotGraph: Large Scale Spamming Botnet Detection Web-account abuse attack recent spamming technic

BotGraph: Large Scale Spamming Botnet Detection Web-account abuse attack recent spamming technic New different approche for sending spam Basing on reputation of email providers Difficult to detect signup detection monitoring users' activity

157 views • 15 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
Outline Intrusion detection systems Malware and the network CSci 5271 Announcements

Outline Intrusion detection systems Malware and the network CSci 5271 Announcements

Outline Intrusion detection systems Malware and the network CSci 5271 Announcements intermission Introduction to Computer Security Middlebox, malware, anonymity combined slides Denial of service and the network Anonymous communications

253 views • 11 slides
Outline Infections of the Brain Infections of the Spine Outline Infections of the

Outline Infections of the Brain Infections of the Spine Outline Infections of the

Update in CNS Infections Brian Schwartz, MD Division of Infectious Diseases, UCSF Outline Infections of the Brain Infections of the Spine Outline Infections of the Brain Infections of the Spine If you would likepick a

663 views • 30 slides
HookFinder: Identifying and Understanding Malware Hooking Behaviors Heng Yin Zhenkai Liang Dawn

HookFinder: Identifying and Understanding Malware Hooking Behaviors Heng Yin Zhenkai Liang Dawn

HookFinder: Identifying and Understanding Malware Hooking Behaviors Heng Yin Zhenkai Liang Dawn Song Carnegie Mellon Univ Carnegie Mellon Univ UC Berkeley Coll Of William and Mary Carnegie Mellon Univ 1 What is a hook? Malware

373 views • 26 slides
Outline in CNS Infections Infections of the Brain Infections of the Spine Brian

Outline in CNS Infections Infections of the Brain Infections of the Spine Brian

2/21/19 Update Outline in CNS Infections Infections of the Brain Infections of the Spine Brian Schwartz, MD Division of Infectious Diseases, UCSF Outline Infections of the Brain Infections of the Spine 1 2/21/19 Case

623 views • 15 slides
Jeffrey D. Ullman Stanford University Spamming = any deliberate action intended solely to

Jeffrey D. Ullman Stanford University Spamming = any deliberate action intended solely to

Jeffrey D. Ullman Stanford University Spamming = any deliberate action intended solely to boost a Web pages position in search- engine results. Web Spam = Web pages that are the result of spamming. SEO industry might disagree!

907 views • 44 slides
Identifying Dormant Functionality in Malware Programs Paolo Milani Comparetti Vienna University

Identifying Dormant Functionality in Malware Programs Paolo Milani Comparetti Vienna University

Int. Secure Systems Lab Vienna University of Technology Identifying Dormant Functionality in Malware Programs Paolo Milani Comparetti Vienna University of Technology Guido Salvaneschi Polotecnico di Milano Engin Kirda Institute Eurecom

726 views • 31 slides
Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci (1,2) , Wenke Lee (1,2) , Nick Feamster (1) (1) (2) USENIX NSDI 2010 Malware = Malicious Software Most modern cyber

601 views • 31 slides
Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements intermission Malware and Denial of Service Stephen McCamant Denial of service and the network University of Minnesota, Computer Science &

168 views • 6 slides
Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements intermission Malware and Denial of Service Stephen McCamant Denial of service and the network University of Minnesota, Computer Science &

526 views • 5 slides
Outline Intrusion detection systems CSci 5271 Malware and the network Introduction to Computer

Outline Intrusion detection systems CSci 5271 Malware and the network Introduction to Computer

Outline Intrusion detection systems CSci 5271 Malware and the network Introduction to Computer Security Announcements intermission Day 22: Malware and Denial of Service Stephen McCamant Denial of service and the network University of

684 views • 10 slides
MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs on a victims system How does it get to run? Attacks a user- or network-facing vulnerable service Backdoor: Added by a malicious

1.02k views • 81 slides
Machine Detectable Network Behavioural Commonalities for Exploits & Malware University of

Machine Detectable Network Behavioural Commonalities for Exploits & Malware University of

Machine Detectable Network Behavioural Commonalities for Exploits & Malware University of Amsterdam Alexandros Stavroulakis MSc System & Network Engineering Research Project II What is this about? Automatic generation of malicious

248 views • 22 slides
T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide

T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide

T owards Network Containment in Malware Analysis Systems Mariano Graziano, Corrado Leita, Davide Balzarotti ACSAC, Orlando, Florida, 3-7 December 2012 Malware Analysis Scenario Analysis based on Sandboxes (API Hooking, Emulation)

798 views • 23 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware Detection From The Network Perspective Using NetFlow Data P. eleda, J. Vykopal, T.

Malware Detection From The Network Perspective Using NetFlow Data P. eleda, J. Vykopal, T.

Malware Detection From The Network Perspective Using NetFlow Data P. eleda, J. Vykopal, T. Plesnk, M. Truneka, V. Krmek {celeda|vykopal|plesnik|trunecka|vojtec}@ics.muni.cz 3rd NMRG Workshop on NetFlow/IPFIX Usage in Network

1.19k views • 36 slides
Identifying Network Traffic Activity Via Flow Sizes Overview Motivation identifying

Identifying Network Traffic Activity Via Flow Sizes Overview Motivation identifying

Identifying Network Traffic Activity Via Flow Sizes Overview Motivation identifying activity via payload Theory behind the idea Measuring NetFlow Measuring DNS traffic captures Implications and future work Motivation

580 views • 17 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
EWB Network 4 22/01/2020 Identifying need and monitoring impact Welcome and cake Introductions

EWB Network 4 22/01/2020 Identifying need and monitoring impact Welcome and cake Introductions

EWB Network 4 22/01/2020 Identifying need and monitoring impact Welcome and cake Introductions Agenda 1. Feedback regarding action point 3 2. Few updates 3. Re-introduce the 8 Model Whole School Approach 4. Public Health BREAK AND NETWORK

324 views • 17 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides

More recommend