.png){kind=icon}
Return
An Exploit Kits Detection Approach Based on HTTP Message Graph
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2021.3080082.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
The exploit kits (EKs) are used by attackers to distribute malware automatically and silently. Existing approaches to EKs detection usually need to perform dynamic analysis on the content contained in the network traffic, which requires dumping all the network traffic and thus causes high detection overhead. Although some approaches detect EKs based on static analysis, they usually fail to restore the complete attack path because of the obstruction set by the attackers. In this paper, we propose an approach that can detect EKs based on only information extracted by static analysis. Our method builds a graph for web sessions and extracts features from the graph to perform EKs detection. The built graph catches important structural characteristics of the interaction during EK attacks that were not revealed in existing methods, with which EKs can be detected with high accuracy. The experiments show that our method works well in both the ground-truth datasets and the latest practical cases. Our method can also identify the malicious websites concealed in EKs, which can further improve the efficiency of analysis.
Keywords:
Feature extraction
Malware
Browsers
Uniform resource locators
Static analysis
Monitoring
Databases
Exploit kits
drive-by download
static analysis
HTTP headers
network traffic analysis
Journal
IF:
8
Papers:
5.4K
Citations:
2.3W
Organization
Cited Papers
A study of the inferior mesenteric and pelvic ganglia of guinea‐pigs with intracellular electrodes
OAAI
OAAIShareSaveShareSaveMarker assisted polycross breeding to increase diversity and yield in perennial ryegrass (Lolium perenne L.).png)
Euphytica
EuphyticaIF0
PREAI
ShareSaveShareSaveORGANIZATIONAL JUSTICE EFFECT ON DEVIANT WORKPLACE BEHAVIORS: MODERATING ROLE OF MORAL DISENGAGEMENT
OAAI
OAAIShareSaveShareSaveShareSaveShareSaveShareSave
View more