Trends in Circumventing Web-Malware Detection

1. Trends in Circumventing Web-Malware Detection Moheeb Abu Rajab, Lucas Ballard, Nav Jagpal, Panayiotis Mavrommatis, Daisuke Nojiri, Niels Provos, Ludwig Schmidt Present by Li Xu UTSA

2. Detecting Malicious Web Sites URL = Uniform Resource Locator http://www.bfuduuioo1fp.mobi/ws/ebayisapi.dll http://fblight.com http://mail.ru http://www.sigkdd.org/kdd2009/index.html • Safe URL? • Web exploit? • Spam-advertised site? • Phishing site? Which pages are safe URLs for end users? This page is reference to Justin Ma’s slides

3. Problem in a Nutshell • Different classes of URLs • Benign, spam, phishing, exploits, scams... • For now, distinguish benign vs. malicious facebook.com fblight.com This page is reference to Justin Ma’s slides

4. State of the Practice • Current approaches • Virtual Machine Honeypots. • Browser Emulation. • Reputation Based Detection. • Signature Based Detection. • Arms race How does adversaries respond & what techniques have been used to bypass detection.

5. Google System

6. Data Collection Data Set I, is the data that is generated by our operational pipeline, i.e., the output of PageScorer. It was generated by processing ∼1.6 billion distinct web pages collected be- tween December 1, 2006 and April 1, 2011. Data Set II, sample pages from data set I suspicious 1% of other “non- suspicious” pages uniformly at random from the same time period. rescore the original HTTP responses a fixed version of PageScorer

8. Attacks on client honeypot

9. Exploits encountered on the web

10. Javascript funtion calls

11. DOM fuctions

12. Malware distribution chain length

13. Cloaking sites & 2 methods comparation

14. 2 methods comparation

16. Summary Social Engineering is growing and poses challenges to VM-based honeypots JavaScript obfuscation that interacts heavily with the DOM can be used to evade both Browser Emulators and AV engines. AV Engines also suffer significantly from both false positives and false negatives. Finally, we see a rise in IP cloaking to thwart content-based detection schemes

17. Granularity As our analysis is based on sites rather than individual web pages, we compute the average value for sites on which we encounter multiple web pages in a given month.

18. Thank You LI XU UTSA