A Linguistic Approach to Detect Exploit Kits in Actual Proxy Logs

• Item type: SIG Technical Reports(1)
• 公開日: 2019-02-25
• タイトル: A Linguistic Approach to Detect Exploit Kits in Actual Proxy Logs
• タイトル / 言語: en
• タイトル: A Linguistic Approach to Detect Exploit Kits in Actual Proxy Logs
• 言語: eng
• キーワード / 主題Scheme: Other
• キーワード / 主題: マルウェア
• 資源タイプ / 資源タイプ識別子: http://purl.org/coar/resource_type/c_18gh
• 資源タイプ: technical report
• 著者所属: National Defense Academy
• 著者所属(英): en
• 著者所属(英): National Defense Academy
• 著者名: Mamoru, Mimura
• 著者名(英): Mamoru, Mimura
• 論文抄録 / 内容記述タイプ: Other
• 論文抄録 / 内容記述: Modern http-based malware imitates benign traffic to evade detection. To detect unseen malicious traffic, a linguistic-based detection method for proxy logs has been proposed. This method extracts words as feature vectors automatically with natural language techniques, and discriminates between benign traffic and malicious traffic. The previous method generates a corpus from the whole extracted words which contain trivial words. To generate discriminative feature representation, a corpus has to be effectively summarized. In actual proxy logs, benign traffic is dominant, and occupies malicious feature representation. Therefore, the previous method does not perform accuracy in practical environment. This paper demonstrates that the previous method is not effective in actual proxy logs because of the imbalance. To mitigate the imbalance, our method extracts important words from proxy logs based on the frequency. We performed cross-validation and timeline analysis with captured pcap files from Exploit Kit and actual proxy logs. The experimental results show our method can detect unseen malicious traffic in actual proxy logs. The best F-measure achieves 0.95 in the timeline analysis.
• 論文抄録(英) / 内容記述タイプ: Other
• 論文抄録(英) / 内容記述: Modern http-based malware imitates benign traffic to evade detection. To detect unseen malicious traffic, a linguistic-based detection method for proxy logs has been proposed. This method extracts words as feature vectors automatically with natural language techniques, and discriminates between benign traffic and malicious traffic. The previous method generates a corpus from the whole extracted words which contain trivial words. To generate discriminative feature representation, a corpus has to be effectively summarized. In actual proxy logs, benign traffic is dominant, and occupies malicious feature representation. Therefore, the previous method does not perform accuracy in practical environment. This paper demonstrates that the previous method is not effective in actual proxy logs because of the imbalance. To mitigate the imbalance, our method extracts important words from proxy logs based on the frequency. We performed cross-validation and timeline analysis with captured pcap files from Exploit Kit and actual proxy logs. The experimental results show our method can detect unseen malicious traffic in actual proxy logs. The best F-measure achieves 0.95 in the timeline analysis.
• 書誌レコードID / 収録物識別子タイプ: NCID
• 書誌レコードID / 収録物識別子: AA11235941
• 書誌情報: 研究報告コンピュータセキュリティ（CSEC）; 巻 2019-CSEC-84, 号 16, p. 1-8, 発行日 2019-02-25
• ISSN / 収録物識別子タイプ: ISSN
• ISSN / 収録物識別子: 2188-8655
• Notice: SIG Technical Reports are nonrefereed and hence may later appear in any journals, conferences, symposia, etc.
• 出版者 / 言語: ja
• 出版者: 情報処理学会