Understanding evasion techniques that abuse differences among javascript implementations

Yuta Takata, Mitsuaki Akiyama, Takeshi Yagi, Takeo Hariu, Shigeki Goto

    研究成果: Conference contribution

    1 被引用数 (Scopus)

    抄録

    There is a common approach to detecting drive-by downloads using a classifier based on the static and dynamic features of malicious websites collected using a honeyclient. However, attackers detect the honeyclient and evade analysis using sophisticated JavaScript code. The evasive code indirectly identifies clients by abusing the differences among JavaScript implementations. Attackers deliver malware only to targeted clients on the basis of the evasion results while avoiding honeyclient analysis. Therefore, we are faced with a problem in that honeyclients cannot extract features from malicious websites and the subsequent classifier does not work. Nevertheless, we can observe the evasion nature, i.e., the results in accessing malicious websites by using targeted clients are different from those by using honeyclients. In this paper, we propose a method of extracting evasive code by leveraging the above differences to investigate current evasion techniques and to use them for analyzing malicious websites. Our method analyzes HTTP transactions of the same website obtained using two types of clients, a real browser as a targeted client and a browser emulator as a honeyclient. As a result of evaluating our method with 8,467 JavaScript samples executed in 20,272 malicious websites, we discovered unknown evasion techniques that abuse the differences among JavaScript implementations. These findings will contribute to improving the analysis capabilities of conventional honeyclients.

    本文言語English
    ホスト出版物のタイトルWeb Information Systems Engineering – WISE 2017 - 18th International Conference, Proceedings
    出版社Springer Verlag
    ページ278-294
    ページ数17
    10570 LNCS
    ISBN(印刷版)9783319687858
    DOI
    出版ステータスPublished - 2017
    イベント18th International Conference on Web Information Systems Engineering, WISE 2017 - Puschino, Russian Federation
    継続期間: 2017 10 72017 10 11

    出版物シリーズ

    名前Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
    10570 LNCS
    ISSN(印刷版)0302-9743
    ISSN(電子版)1611-3349

    Other

    Other18th International Conference on Web Information Systems Engineering, WISE 2017
    国/地域Russian Federation
    CityPuschino
    Period17/10/717/10/11

    ASJC Scopus subject areas

    • 理論的コンピュータサイエンス
    • コンピュータ サイエンス(全般)

    フィンガープリント

    「Understanding evasion techniques that abuse differences among javascript implementations」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

    引用スタイル