Analyzing HTTP User Agent Anomalies for Malware Detection

Abstract

This paper analyzes User Agent (UA) anomalies within malware HTTP traffic and extracts signatures for malware detection. We observe, within a large set of malware HTTP traffic provided by a local AV company, that almost one malware out of eight uses a suspicious UA header in at least one HTTP request. Such anomalies include typos, information leakage, outdated versions, and attack vectors such as XSS and SQL injection. Nowadays UA anomalies are still manually analyzed, whereas thousands of new malware samples are collected daily. On the other hand, just blacklisting unusual UA strings is not viable because malware developers may use random values or encode variable patterns. This paper automatically classifies UA anomalies and extracts signatures for malware detection. Our approach is implemented on top of network-based detection systems. We extracted signatures from an overall set of 100 thousand malware samples, and we tested these signatures on real-world malware traffic. Experimental results show that our solution detects unknown malware by the time of extracting our signatures.