TIIS (한국인터넷정보학회)
Current Result Document : 1 / 1
| 한글제목(Korean Title) |
HAS-Analyzer: Detecting HTTP-based C&C based on the Analysis of HTTP Activity Sets |
| 영문제목(English Title) |
HAS-Analyzer: Detecting HTTP-based C&C based on the Analysis of HTTP Activity Sets |
| 저자(Author) |
Sung-Jin Kim
Sungryoul Lee
Byungchul Bae
|
| 원문수록처(Citation) |
VOL 08 NO. 05 PP. 1801 ~ 1816 (2014. 05) |
한글내용
(Korean Abstract) |
|
영문내용
(English Abstract) |
Because HTTP-related ports are allowed through firewalls, they are an obvious point for launching cyber attacks. In particular, malware uses HTTP protocols to communicate with their master servers. We call this an HTTP-based command and control (C&C) server. Most previous studies concentrated on the behavioral pattern of C&Cs. However, these approaches need a well-defined white list to reduce the false positive rate because there are many benign applications, such as automatic update checks and web refreshes, that have a periodic access pattern. In this paper, we focus on finding new discriminative features of HTTP-based C&Cs by analyzing HTTP activity sets. First, a C&C shows a few connections at a time (low density). Second, the content of a request or a response is changed frequently among consecutive C&Cs (high content variability). Based on these two features, we propose a novel C&C analysis mechanism that detects the HTTP-based C&C. The HAS-Analyzer can classify the HTTP-based C&C with an accuracy of more than 96% and a false positive rate of 1.3% without using any white list.
|
| 키워드(Keyword) |
Network security
botnet detection
HTTP-based C&C
|
| 파일첨부 |
PDF 다운로드
|
