Abstract
This paper analyzes User Agent (UA) anomalies within malware HTTP traffic and extracts signatures for malware detection. We observe, within a large set of malware HTTP traffic provided by a local AV company, that almost one malware out of eight uses a suspicious UA header in at least one HTTP request. Such anomalies include typos, information leakage, outdated versions, and attack vectors such as XSS and SQL injection. Nowadays UA anomalies are still manually analyzed, whereas thousands of new malware samples are collected daily. On the other hand, just blacklisting unusual UA strings is not viable because malware developers may use random values or encode variable patterns. This paper automatically classifies UA anomalies and extracts signatures for malware detection. Our approach is implemented on top of network-based detection systems. We extracted signatures from an overall set of 100 thousand malware samples, and we tested these signatures on real-world malware traffic. Experimental results show that our solution detects unknown malware by the time of extracting our signatures.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.