CzubiśÂski Antoni [red] II Wojna śÂwiatowa i jej nastćÂpstwa
Timothy Zahn Cobra 2 Cobra Strike
665. Pershing Diane Bratnie dusze Przybysz z krainy wyobraśĹźni
Collins Jackie Grzesznicy
Graham Greene Moc i chwala
Celmer, Michelle Black Gold Billionaires 02 Eiskalte Geschafte, heisses Verlangen
Shaw Chantelle Greek Husbands Szafirowy naszyjnik (śÂwiatowe śąycie Duo 417)
Honor 06 Honor Under Siege Radclyffe
Glen Cook Dread Empire 06 Reap The East Wind
Diana Palmer The Marist Sisters 03 Outs
[ Pobierz całość w formacie PDF ]
malware sandbox. In this instance,
Some systems, for example, solely base
the decrypted contents, as is done by
malware is directly installed on a
signatures upon the payload data of
Rossow et al [104]. They take advantage
machine and the activities analysed.
packets, while others can cover entire
of the fact that in many cases the
The main difference with a honeynet,
flows and the timings of packets. It
encryption used is very simple, and often
however, is that the owner will also
is also not the case that one piece of
the key for encryption is hardcoded
interact with the malware (for example,
malware will be represented by a single
into the malware binary. They keys are
by mimicking command and control
signature, and vice versa. It is often
fetched by reverse engineering, and
servers). This allows the researcher
the case that a single malware sample
then the payloads can be decrypted,
University of Birmingham | CPNI.gov.uk PAGE 20
Command & Control: Understanding, Denying and Detecting FEBRUARY 2014
C&C Detection
ans signature-based detection applied. related to malicious activities [6]. In
Server Detection
The obvious down- side to this method this system (Notos), domains are
is that it requires the labour intensive clustered in two ways. First, they are
Nelms et al. [86] propose ExecScent, a
reverse engineeing step. clustered according to the IP addresses
system for identifying malicious domains
Further to this, Rafique et al. [102] associated with them. Secondly, they
within network traffic. The system works
proposed a system for large-scale are clustered according to similarities
by creating network traces from known
automatic signature generation. The in the syntactic structure of the domain
malware samples to create signatures,
system uses network traces collected names themselves. These clusters
that can then be compared with network
from sandboxes and produces are then classified as malicious or not
traffic. The sig- natures are not just
signatures for groups of similar malware, based upon a collection of whitelists
based upon the domain names, but
covering numerous protocols. This and blacklists: domains in a cluster that
also the full HTTP requests associated
system is able to identify numerous contains blacklist domains are likely to
with them. How this system is unique,
malware example with a high rate, and be malicious themselves. This system
however, is that the signatures are
experiences a low false positive rate is run on local DNS servers and can
tailored to the network that they will be
due to the specificness of the signatures achieve a true positive rate of 96% and
used on based upon the background
generated. The signatures are designed an low false positive rate. In a further
network traffic. This step is extremely
to be exported to intrusion detection piece of work from the same authors as
useful at reducing the level of false
systems such as Snort for on-line Notos, the idea is vastly expanded to
positives by exploiting the fact that
detection. use the global view of the upper DNS
different networks will exhibit different
hierarchy. In this new system (Kopis) [7],
browsing behaviour (for example a car
a classifier is built that, instead of looking
Spam Detection manufacturer is unlikely to visit the same
at the domains IP and name, looks at
websites as a hospital).
the hosts that make the DNS requests.
There have also been attempts at
They leverage the fact that malware-
performing spam detection based E.4 Non-Signature Based
related domains are likely to have an
upon the method that the spam email
Methods
inconsistent, varied pool of requesting
was sent, which is quite often through
hosts, compared to a legitimate domain
malware. The work of Stringhini et al
The main disadvantage of using a
which will be much more consistent.
[118] utilises the fact that many different
signature based detection method
They also look at the locations of the
mail clients, including malware, introduce
is that these detection systems are
requesters: requesters inside large
slight variations into the standard SMTP
usually not very effective at detecting
networks are given higher weighting as
protocol. They use this to produce
new, or updated, malware. Every time
a large network is more likely to contain
dialects , which are signatures for
a new piece of malware is discovered,
infected machines. When tested, this
each mail client that can represent
or an exiting piece updates itself, the
system was actually able to identify a
these variations. Dialects are collected
signatures have to be recreated. If the
new botnet based in China, which was
for known sources of spam, including
new variant is not discovered, then it is
later removed from the internet.
malware, and also for legitimate mail
unlikely to be detected by these systems.
DNS is also used in another way by
services. It is then a simple case of
This is where non-signature based
malware controllers that we have not yet
matching incoming emails to a dialect to
detection comes in. In these systems,
mentioned. One feature of DNS is DNS
make the decision of if the email is spam.
the algorithms look for behaviour that [ Pobierz całość w formacie PDF ]
