Title
NetGator: malware detection using program interactive challenges
Abstract
Internet-borne threats have evolved from easy to detect denial of service attacks to zero-day exploits used for targeted exfiltration of data. Current intrusion detection systems cannot always keep-up with zero-day attacks and it is often the case that valuable data have already been communicated to an external party over an encrypted or plain text connection before the intrusion is detected. In this paper, we present a scalable approach called Network Interrogator (NetGator) to detect network-based malware that attempts to exfiltrate data over open ports and protocols. NetGator operates as a transparent proxy using protocol analysis to first identify the declared client application using known network flow signatures.Then we craft packets that "challenge" the application by exercising functionality present in legitimate applications but too complex or intricate to be present in malware. When the application is unable to correctly solve and respond to the challenge, NetGator flags the flow as potential malware. Our approach is seamless and requires no interaction from the user and no changes on the commodity application software. NetGator introduces a minimal traffic latency (0.35 seconds on average) to normal network communication while it can expose a wide-range of existing malware threats.
Year
DOI
Venue
2012
10.1007/978-3-642-37300-8_10
DIMVA
Keywords
Field
DocType
malware threat,malware detection,commodity application software,valuable data,client application,program interactive challenge,current intrusion detection system,functionality present,potential malware,network-based malware,legitimate application,netgator flag
Cryptovirology,Denial-of-service attack,Computer security,Computer science,Network packet,Exploit,Malware,Application software,Intrusion detection system,User agent
Conference
Citations 
PageRank 
References 
2
0.40
16
Authors
4
Name
Order
Citations
PageRank
Brian Schulte150.85
Haris Andrianakis220.40
Kun Sun314212.80
Angelos Stavrou4128898.69