Detecting Malware-Infected Devices Using the HTTP Header Patterns

Sho MIZUNO; Mitsuhiro HATADA; Tatsuya MORI; Shigeki GOTO

doi:10.1587/transinf.2017EDP7294

Detecting Malware-Infected Devices Using the HTTP Header Patterns

Sho MIZUNO, Mitsuhiro HATADA, Tatsuya MORI, Shigeki GOTO

Full Text Views

0

Cite this

Summary :

Damage caused by malware has become a serious problem. The recent rise in the spread of evasive malware has made it difficult to detect it at the pre-infection timing. Malware detection at post-infection timing is a promising approach that fulfills this gap. Given this background, this work aims to identify likely malware-infected devices from the measurement of Internet traffic. The advantage of the traffic-measurement-based approach is that it enables us to monitor a large number of endhosts. If we find an endhost as a source of malicious traffic, the endhost is likely a malware-infected device. Since the majority of malware today makes use of the web as a means to communicate with the C&C servers that reside on the external network, we leverage information recorded in the HTTP headers to discriminate between malicious and benign traffic. To make our approach scalable and robust, we develop the automatic template generation scheme that drastically reduces the amount of information to be kept while achieving the high accuracy of classification; since it does not make use of any domain knowledge, the approach should be robust against changes of malware. We apply several classifiers, which include machine learning algorithms, to the extracted templates and classify traffic into two categories: malicious and benign. Our extensive experiments demonstrate that our approach discriminates between malicious and benign traffic with up to 97.1% precision while maintaining the false positive rate below 1.0%.

Publication: IEICE TRANSACTIONS on Information Vol.E101-D No.5 pp.1370-1379

Publication Date: 2018/05/01

Publicized: 2018/02/08

Online ISSN: 1745-1361

DOI: 10.1587/transinf.2017EDP7294

Type of Manuscript: PAPER

Category: Information Network

Authors

Sho MIZUNO
  Waseda University
Mitsuhiro HATADA
  Waseda University,NTT Communications Corporation
Tatsuya MORI
  Waseda University
Shigeki GOTO
  Waseda University

Keyword

botnet detection, malicious traffic, HTTP header, automatic template generation

Cite this

Copy

Sho MIZUNO, Mitsuhiro HATADA, Tatsuya MORI, Shigeki GOTO, "Detecting Malware-Infected Devices Using the HTTP Header Patterns" in IEICE TRANSACTIONS on Information, vol. E101-D, no. 5, pp. 1370-1379, May 2018, doi: 10.1587/transinf.2017EDP7294.
Abstract: Damage caused by malware has become a serious problem. The recent rise in the spread of evasive malware has made it difficult to detect it at the pre-infection timing. Malware detection at post-infection timing is a promising approach that fulfills this gap. Given this background, this work aims to identify likely malware-infected devices from the measurement of Internet traffic. The advantage of the traffic-measurement-based approach is that it enables us to monitor a large number of endhosts. If we find an endhost as a source of malicious traffic, the endhost is likely a malware-infected device. Since the majority of malware today makes use of the web as a means to communicate with the C&C servers that reside on the external network, we leverage information recorded in the HTTP headers to discriminate between malicious and benign traffic. To make our approach scalable and robust, we develop the automatic template generation scheme that drastically reduces the amount of information to be kept while achieving the high accuracy of classification; since it does not make use of any domain knowledge, the approach should be robust against changes of malware. We apply several classifiers, which include machine learning algorithms, to the extracted templates and classify traffic into two categories: malicious and benign. Our extensive experiments demonstrate that our approach discriminates between malicious and benign traffic with up to 97.1% precision while maintaining the false positive rate below 1.0%.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2017EDP7294/_p

Copy

@ARTICLE{e101-d_5_1370,
author={Sho MIZUNO, Mitsuhiro HATADA, Tatsuya MORI, Shigeki GOTO, },
journal={IEICE TRANSACTIONS on Information},
title={Detecting Malware-Infected Devices Using the HTTP Header Patterns},
year={2018},
volume={E101-D},
number={5},
pages={1370-1379},
abstract={Damage caused by malware has become a serious problem. The recent rise in the spread of evasive malware has made it difficult to detect it at the pre-infection timing. Malware detection at post-infection timing is a promising approach that fulfills this gap. Given this background, this work aims to identify likely malware-infected devices from the measurement of Internet traffic. The advantage of the traffic-measurement-based approach is that it enables us to monitor a large number of endhosts. If we find an endhost as a source of malicious traffic, the endhost is likely a malware-infected device. Since the majority of malware today makes use of the web as a means to communicate with the C&C servers that reside on the external network, we leverage information recorded in the HTTP headers to discriminate between malicious and benign traffic. To make our approach scalable and robust, we develop the automatic template generation scheme that drastically reduces the amount of information to be kept while achieving the high accuracy of classification; since it does not make use of any domain knowledge, the approach should be robust against changes of malware. We apply several classifiers, which include machine learning algorithms, to the extracted templates and classify traffic into two categories: malicious and benign. Our extensive experiments demonstrate that our approach discriminates between malicious and benign traffic with up to 97.1% precision while maintaining the false positive rate below 1.0%.},
keywords={},
doi={10.1587/transinf.2017EDP7294},
ISSN={1745-1361},
month={May},}

Copy

TY - JOUR
TI - Detecting Malware-Infected Devices Using the HTTP Header Patterns
T2 - IEICE TRANSACTIONS on Information
SP - 1370
EP - 1379
AU - Sho MIZUNO
AU - Mitsuhiro HATADA
AU - Tatsuya MORI
AU - Shigeki GOTO
PY - 2018
DO - 10.1587/transinf.2017EDP7294
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E101-D
IS - 5
JA - IEICE TRANSACTIONS on Information
Y1 - May 2018
AB - Damage caused by malware has become a serious problem. The recent rise in the spread of evasive malware has made it difficult to detect it at the pre-infection timing. Malware detection at post-infection timing is a promising approach that fulfills this gap. Given this background, this work aims to identify likely malware-infected devices from the measurement of Internet traffic. The advantage of the traffic-measurement-based approach is that it enables us to monitor a large number of endhosts. If we find an endhost as a source of malicious traffic, the endhost is likely a malware-infected device. Since the majority of malware today makes use of the web as a means to communicate with the C&C servers that reside on the external network, we leverage information recorded in the HTTP headers to discriminate between malicious and benign traffic. To make our approach scalable and robust, we develop the automatic template generation scheme that drastically reduces the amount of information to be kept while achieving the high accuracy of classification; since it does not make use of any domain knowledge, the approach should be robust against changes of malware. We apply several classifiers, which include machine learning algorithms, to the extracted templates and classify traffic into two categories: malicious and benign. Our extensive experiments demonstrate that our approach discriminates between malicious and benign traffic with up to 97.1% precision while maintaining the false positive rate below 1.0%.
ER -