Browse > Article
http://dx.doi.org/10.13089/JKIISC.2011.21.4.61

Research on Malicious code hidden website detection method through WhiteList-based Malicious code Behavior Analysis  

Ha, Jung-Woo (Korea University, Graduate School for Information Management Engineering)
Kim, Huy-Kang (Korea University, Graduate School for Information Management Engineering)
Lim, Jong-In (Korea University, Graduate School for Information Management Engineering)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.21, no.4, 2011 , pp. 61-75 More about this Journal
Abstract
Recently, there is significant increasing of massive attacks, which try to infect PCs that visit websites containing pre-implanted malicious code. When visiting the websites, these hidden malicious codes can gain monetary profit or can send various cyber attacks such as BOTNET for DDoS attacks, personal information theft and, etc. Also, this kind of malicious activities is continuously increasing, and their evasion techniques become professional and intellectual. So far, the current signature-based detection to detect websites, which contain malicious codes has a limitation to prevent internet users from being exposed to malicious codes. Since, it is impossible to detect with only blacklist when an attacker changes the string in the malicious codes proactively. In this paper, we propose a novel approach that can detect unknown malicious code, which is not well detected by a signature-based detection. Our method can detect new malicious codes even though the codes' signatures are not in the pattern database of Anti-Virus program. Moreover, our method can overcome various obfuscation techniques such as the frequent change of the included redirection URL in the malicious codes. Finally, we confirm that our proposed system shows better detection performance rather than MC-Finder, which adopts pattern matching, Google's crawling based malware site detection, and McAfee.
Keywords
Zomebie PC; Worm; Virus;
Citations & Related Records
연도 인용수 순위
  • Reference
1 Prabhat K. Singh and Arun Lakhotia. Analysis and detection of computer viruses and worms: An annotated bibliography. ACM SIGPLAN Notices, 37(2) pp. 29-35, February 2002.
2 NIE(Internet Explorer)ls Provos Panayiotis Mavrommatis Google Inc , "All Your iFRAMEs Point to Us "Google Technical Report provos-2008a, pp. 28-40, February 2008
3 Google Code Labs, Google Safe Browsing API Developer's Guide, http://code.google. com/intl/ko-KR/apis/safebrowsing/developers_guide.html
4 MSDN Library, Process and Thread Functions, http://msdn.microsoft.com/ en-us/library/ms687393(VS.85).aspx, 2008
5 MSDN Library, Process and Thread Functions, http://msdn.microsoft.com/ en-us/library/bb762153(VS.85).aspx, 2008
6 Systemsoftware Mathias Rauen, madCodeHook, http://www.madshi.net, 2010
7 McAfee, Mapping the Mal Web, http://www.siteadvisor.com/studies/Mapping_Mal_Web_jun2009.pdf, 2009
8 Mihai Christodorescu, Somesh Jha, Sanjit A. Seshia, Dawn Song, and Randal E. Bryant. Semantics-aware malware detection. In Proceedings of the 2005 IEEE Symposium on Security and Privacy, Oakland, CA, pp. 50-51, May 2005.
9 Yi-Min Wang, Roussi Roussev, Chad Verbowski, Aaron Johnson, Ming-Wei Wu, Yennun Huang, and Sy-Yen Kuo. Gatekeeper: Monitoring auto-start extensibility points (ASEPs) for spyware management. In Proceedings of the 18th Large Installation System Administration Conference (LISA '04), Atlanta, GA, pp. 1-5, November 2004.
10 Darrell M. Kienzle and Matthew C. Elder. Recent worms: A survey and trends. In Proceedings of the 2003 ACM Workshop on Rapid Malcode, Washington, DC, pp. 40-49, October 2003.
11 David Moore, Vern Paxson, Stefan Savage, Colleen Shannon an d Stuart Staniford, and Nicholas Weaver. Inside the slammer worm. IEEE Security and Privacy, 1(4), pp. 33-39, July 2003.   DOI   ScienceOn
12 한국인터넷진흥원, "2009 정보시스템 해킹.바이러스 현황 및 대응," 연구보고서 KISA-RP-2009-0014, pp.17-18, 2009.
13 심원태, "악성코드 은닉사이트 탐지시스템 개발과 운영(MCFinder)," 제 11회 정보보호 심포지움 SIS. pp.5-6, 2006
14 NIE(Internet Explorer)ls Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang, Negendra Modadugu, "The Ghost In The Browser Analysis of Web-based Malware," Proceedings of the first conference on First Workshop on Hot Topics in Understanding Bonets, pp. 35-37. April 2007
15 Yi-Min Wang, Doug Beck, Xuxian Jiang, Roussi Roussev, Chad Verbowski, Shuo Chen, and Sam King. Automated Web Patrol with Strider HoneyMonkeys. In Proceedings of the 2006 Network and Distributed System Security Symposium, pp. 35-49, February 2006
16 Alexander Moshchuk, Tanya Bragin, Steven D. Gribble, and Henry M. Levy. A Crawler-based Study of Spyware on the Web. In Proceedings of the 2006 Network and Distributed System Security Symposium, pp. 39-40, February 2006.