Common Attack Vectors Research Articles

A Combined Static and Dynamic Analysis Approach to Detect Malicious Browser Extensions

Ill-intentioned browser extensions pose an emergent security risk and have become one of the most common attack vectors on the Internet due to their wide popularity and high privilege. Once installed, malicious extensions are executed and attempt to compromise a victim’s browser. To detect malicious browser extensions, security researchers have put forward several techniques. These techniques primarily concentrate on the usage of API calls by malicious extensions, imposing restricted policies for extensions, and monitoring extension’s activities. In this paper, we propose a machine-learning-based approach to detect malicious extensions. We apply static and dynamic techniques to analyse an extension for extracting features. The analysis process extracts features from the source codes including JavaScript codes, HTML pages, and CSS files and the execution activities of an extension. To guarantee the robustness of the features, a feature selection method is then applied to retain the most relevant features while discarding low-correlated features. The detection models based on machine-learning techniques are subsequently constructed by leveraging these features. As can be seen from evaluation results, our detection model, containing over 4,600 labelled extension samples, is able to detect malicious extensions with an accuracy of 96.52% in validation set and 95.18% in test set, with a false positive rate of 2.38% in validation set and 3.66% in test set.

Cyber Crime Nation Typologies: K-Means Clustering of Countries Based on Cyber Crime Rates

IntroductionA disproportionate amount of the cyber crime attacks worldwide are accounted for by a minority of countries (Spamhaus, 2016). Many reports, mostly by cyber security firms, regularly conduct rankings of nations based on being top sources of cyber crime activity and attacks2. Nations are differentiated based on the particular type of cyber crime or offense that they are associated with (APWG, 2014; Ultrascan, 2014; V.I. Labs, 2014).However, most of the reporting is univariate and descriptive, offering a simple unidimensional listing of nations by rank via one metric at a time. The reports also offer little in the way of also ranking nations in the context of non-cyber crime variables, such as economic and technological metrics at the national level. There have been some multivariate macro-level cyber crime studies at the national level, which seek to identify inferential predictors of cyber crime rates between nations (Kigerl, 2013; 2016).Among some of the multivariate studies conducted, the degree of internet connectivity within a nation has been found to consistently predict higher levels of multiple cyber crime types, including fraud, malware, spam, and digital piracy (Kigerl, 2013; 2016). Nations that are the source of spam and digital piracy are also more likely to be wealthier countries, measured in the form of a nation's gross domestic product (GDP). However, the findings are more mixed in regards to GDP's relationship to fraud and malware.Yet these studies say little about how specific nations specialize in cyber crime, or how nations can be grouped under different typologies with varying cyber crime profiles. Predictors linked to cyber crime outcomes are assumed to be equally predictive across nations. The present research cannot describe the distinct differences between nations, only between variables.The present research seeks to address this gap by performing K-means clustering analysis at the national level among 190 countries using seven cyber crime variables capturing fraud, malware, spam, and digital piracy, as well as each nation's GDP and internet use per capita. The results are intended to better understand the differences between individual countries by assigning them to discrete categories, rather than identifying the general relationship of various economic, technological, and legal differences between nations on cyber crime outcomes. Via clustering analysis techniques, nations may be grouped together with similar nations, attempting to identify if certain countries specialize in cyber crime, or act as cyber crime generalists.Cyber crime differences between CountriesThe internet is scattered with many reports and posts about the top cyber crime countries, the biggest source of cyber attacks, and the most likely home of residence for cyber criminals themselves. Multiple cyber security firms regularly release detailed reports on the state of cyber crime activities within their networks, often including a section on countries. Symantec has created an index of cyber crime activity that includes hosting malware, botnets, phishing server hosting, and how many botnet command and control (C&C) servers there are within each nation. The top Five nations on this index include the US, China, Brazil, Germany, and India. Russia is seventh (Fossi, Turner, Johnson, Mack, Adams, et al., 2010).The harms of the various cyber crimes are well advertised in such reports. Email spam is a common attack vector for multiple types of cyber crime (Rao & Reiley, 2012). Today, spam makes up 72% of all emails sent worldwide (Gudkova, 2013). Over half of all internet traffic in general not just that of email traffic, is actually spam (Lachhwani & Ghose, 2012). Loss of human resources due to the nuisance of spam was estimated to be at $22 billion in 2004 (Lachhwani & Ghose, 2012). Some of the top spam sending countries include China, Brazil, the United States, and Russia (Project Honey Pot, 2016). …

Between Worlds: Securing Mixed JavaScript/ActionScript Multi-Party Web Content

Mixed Flash and JavaScript content has become increasingly prevalent; its purveyance of dynamic features unique to each platform has popularized it for myriad web development projects. Although Flash and JavaScript security has been examined extensively, the security of untrusted content that combines both has received considerably less attention. This article considers this fusion in detail, outlining several practical scenarios that threaten the security of web applications. The severity of these attacks warrants the development of new techniques that address the security of Flash-JavaScript content considered as a whole, in contrast to prior solutions that have examined Flash or JavaScript security individually. Toward this end, the article presents FlashJaX, a cross-platform solution that enforces fine-grained, history-based policies that span both Flash and JavaScript. Using in-lined reference monitoring, FlashJaX safely embeds untrusted JavaScript and Flash content in web pages without modifying browser clients or using special plug-ins. The architecture of FlashJaX, its design and implementation, and a detailed security analysis are exposited. Experiments with advertisements from popular ad networks demonstrate that FlashJaX is transparent to policy-compliant advertisement content, yet blocks many common attack vectors that exploit the fusion of these web platforms.

Efficient and effective realtime prediction of drive-by download attacks

Drive-by download attacks are common attack vector for compromising personal computers. While several alternatives to mitigate the threat have been proposed, approaches to realtime detection of drive-by download attacks has been predominantly limited to static and semi-dynamic analysis techniques. These techniques examine the original or deobfuscated JavaScript source code to assess the potential maliciousness of a webpage. However, static and semi-dynamic analysis techniques are vulnerable to commonly employed evasion techniques. Dynamic anomaly detection approaches are less susceptible to targeted evasion, but are used less often as a realtime solution on the individual systems because these techniques are typically resource intensive. This paper presents a novel approach to detect drive-by downloads in web browser environments using low resource dynamic analysis. By dynamically monitoring the bytecode stream generated by a web browser during rendering, the approach is able to detect previously unseen drive-by download attacks at runtime. The proposed method is effective, space efficient, and performs the analysis with low performance overhead, making the approach amenable to in-browser drive-by download detection on resource constrained devices, such as mobile phones.

Modeling Cyber-Physical Vulnerability of the Smart Grid With Incomplete Information

This paper addresses the attack modeling using vulnerability of information, communication and electric grid network. Vulnerability of electric grid with incomplete information has been analyzed using graph theory based approach. Vulnerability of information and communication (cyber) network has been modeled utilizing concepts of discovery, access, feasibility, communication speed and detection threat. Common attack vector based on vulnerability of cyber and physical system have been utilized to operate breakers associated with generating resources to model aurora-like event. Real time simulations for modified IEEE 14 bus test case system and graph theory analysis for IEEE 118 bus system have been presented. Test case results show the possible impact on smart grid caused by integrated cyber-physical attack.