Evaluations and Analysis of Malware Prevention Methods on Websites

Takeshi YAGI; Junichi MURAYAMA; Takeo HARIU; Hiroyuki OHSAKI

doi:10.1587/transcom.E96.B.3091

Evaluations and Analysis of Malware Prevention Methods on Websites

Takeshi YAGI, Junichi MURAYAMA, Takeo HARIU, Hiroyuki OHSAKI

Full Text Views

0

Cite this

Summary :

With the diffusion of web services caused by the appearance of a new architecture known as cloud computing, a large number of websites have been used by attackers as hopping sites to attack other websites and user terminals because many vulnerable websites are constructed and managed by unskilled users. To construct hopping sites, many attackers force victims to download malware by using vulnerabilities in web applications. To protect websites from these malware infection attacks, conventional methods, such as using anti-virus software, filter files from attackers using pattern files generated by analyzing conventional malware files collected by security vendors. In addition, certain anti-virus software uses a behavior blocking approach, which monitors malicious file activities and modifications. These methods can detect malware files that are already known. However, it is difficult to detect malware that is different from known malware. It is also difficult to define malware since legitimate software files can become malicious depending on the situation. We previously proposed an access filtering method based on communication opponents, which are other servers or terminals that connect with our web honeypots, of attacks collected by web honeypots, which collect malware infection attacks to websites by using actual vulnerable web applications. In this blacklist-based method, URLs or IP addresses, which are used in malware infection attacks collected by web honeypots, are listed in a blacklist, and accesses to and from websites are filtered based on the blacklist. To reveal the effects in an actual attack situation on the Internet, we evaluated the detection ratio of anti-virus software, our method, and a composite of both methods. Our evaluation revealed that anti-virus software detected approximately 50% of malware files, our method detected approximately 98% of attacks, and the composite of the two methods could detect approximately 99% of attacks.

Publication: IEICE TRANSACTIONS on Communications Vol.E96-B No.12 pp.3091-3100

Publication Date: 2013/12/01

Publicized

Online ISSN: 1745-1345

DOI: 10.1587/transcom.E96.B.3091

Type of Manuscript: PAPER

Category: Internet

Authors

Takeshi YAGI
  NTT Corporation
Junichi MURAYAMA
  NTT Corporation
Takeo HARIU
  NTT Corporation
Hiroyuki OHSAKI
  Osaka University

Keyword

security, web, honeypot, malware, anti-virus, blacklist, access filtering

Cite this

Copy

Takeshi YAGI, Junichi MURAYAMA, Takeo HARIU, Hiroyuki OHSAKI, "Evaluations and Analysis of Malware Prevention Methods on Websites" in IEICE TRANSACTIONS on Communications, vol. E96-B, no. 12, pp. 3091-3100, December 2013, doi: 10.1587/transcom.E96.B.3091.
Abstract: With the diffusion of web services caused by the appearance of a new architecture known as cloud computing, a large number of websites have been used by attackers as hopping sites to attack other websites and user terminals because many vulnerable websites are constructed and managed by unskilled users. To construct hopping sites, many attackers force victims to download malware by using vulnerabilities in web applications. To protect websites from these malware infection attacks, conventional methods, such as using anti-virus software, filter files from attackers using pattern files generated by analyzing conventional malware files collected by security vendors. In addition, certain anti-virus software uses a behavior blocking approach, which monitors malicious file activities and modifications. These methods can detect malware files that are already known. However, it is difficult to detect malware that is different from known malware. It is also difficult to define malware since legitimate software files can become malicious depending on the situation. We previously proposed an access filtering method based on communication opponents, which are other servers or terminals that connect with our web honeypots, of attacks collected by web honeypots, which collect malware infection attacks to websites by using actual vulnerable web applications. In this blacklist-based method, URLs or IP addresses, which are used in malware infection attacks collected by web honeypots, are listed in a blacklist, and accesses to and from websites are filtered based on the blacklist. To reveal the effects in an actual attack situation on the Internet, we evaluated the detection ratio of anti-virus software, our method, and a composite of both methods. Our evaluation revealed that anti-virus software detected approximately 50% of malware files, our method detected approximately 98% of attacks, and the composite of the two methods could detect approximately 99% of attacks.
URL: https://global.ieice.org/en_transactions/communications/10.1587/transcom.E96.B.3091/_p

Copy

@ARTICLE{e96-b_12_3091,
author={Takeshi YAGI, Junichi MURAYAMA, Takeo HARIU, Hiroyuki OHSAKI, },
journal={IEICE TRANSACTIONS on Communications},
title={Evaluations and Analysis of Malware Prevention Methods on Websites},
year={2013},
volume={E96-B},
number={12},
pages={3091-3100},
abstract={With the diffusion of web services caused by the appearance of a new architecture known as cloud computing, a large number of websites have been used by attackers as hopping sites to attack other websites and user terminals because many vulnerable websites are constructed and managed by unskilled users. To construct hopping sites, many attackers force victims to download malware by using vulnerabilities in web applications. To protect websites from these malware infection attacks, conventional methods, such as using anti-virus software, filter files from attackers using pattern files generated by analyzing conventional malware files collected by security vendors. In addition, certain anti-virus software uses a behavior blocking approach, which monitors malicious file activities and modifications. These methods can detect malware files that are already known. However, it is difficult to detect malware that is different from known malware. It is also difficult to define malware since legitimate software files can become malicious depending on the situation. We previously proposed an access filtering method based on communication opponents, which are other servers or terminals that connect with our web honeypots, of attacks collected by web honeypots, which collect malware infection attacks to websites by using actual vulnerable web applications. In this blacklist-based method, URLs or IP addresses, which are used in malware infection attacks collected by web honeypots, are listed in a blacklist, and accesses to and from websites are filtered based on the blacklist. To reveal the effects in an actual attack situation on the Internet, we evaluated the detection ratio of anti-virus software, our method, and a composite of both methods. Our evaluation revealed that anti-virus software detected approximately 50% of malware files, our method detected approximately 98% of attacks, and the composite of the two methods could detect approximately 99% of attacks.},
keywords={},
doi={10.1587/transcom.E96.B.3091},
ISSN={1745-1345},
month={December},}

Copy

TY - JOUR
TI - Evaluations and Analysis of Malware Prevention Methods on Websites
T2 - IEICE TRANSACTIONS on Communications
SP - 3091
EP - 3100
AU - Takeshi YAGI
AU - Junichi MURAYAMA
AU - Takeo HARIU
AU - Hiroyuki OHSAKI
PY - 2013
DO - 10.1587/transcom.E96.B.3091
JO - IEICE TRANSACTIONS on Communications
SN - 1745-1345
VL - E96-B
IS - 12
JA - IEICE TRANSACTIONS on Communications
Y1 - December 2013
AB - With the diffusion of web services caused by the appearance of a new architecture known as cloud computing, a large number of websites have been used by attackers as hopping sites to attack other websites and user terminals because many vulnerable websites are constructed and managed by unskilled users. To construct hopping sites, many attackers force victims to download malware by using vulnerabilities in web applications. To protect websites from these malware infection attacks, conventional methods, such as using anti-virus software, filter files from attackers using pattern files generated by analyzing conventional malware files collected by security vendors. In addition, certain anti-virus software uses a behavior blocking approach, which monitors malicious file activities and modifications. These methods can detect malware files that are already known. However, it is difficult to detect malware that is different from known malware. It is also difficult to define malware since legitimate software files can become malicious depending on the situation. We previously proposed an access filtering method based on communication opponents, which are other servers or terminals that connect with our web honeypots, of attacks collected by web honeypots, which collect malware infection attacks to websites by using actual vulnerable web applications. In this blacklist-based method, URLs or IP addresses, which are used in malware infection attacks collected by web honeypots, are listed in a blacklist, and accesses to and from websites are filtered based on the blacklist. To reveal the effects in an actual attack situation on the Internet, we evaluated the detection ratio of anti-virus software, our method, and a composite of both methods. Our evaluation revealed that anti-virus software detected approximately 50% of malware files, our method detected approximately 98% of attacks, and the composite of the two methods could detect approximately 99% of attacks.
ER -