TY - GEN
T1 - Automated classification of C&C connections through malware URL clustering
AU - Kheir, Nizar
AU - Blanc, Gregory
AU - Debar, Hervé
AU - Garcia-Alfaro, Joaquin
AU - Yang, Dingqi
N1 - Publisher Copyright:
© IFIP International Federation for Information Processing 2015.
PY - 2015/1/1
Y1 - 2015/1/1
N2 - We present WebVisor, an automated tool to derive patterns from malware Command and Control (C&C) server connections. From collective network communications stored on a large-scale malware dataset, WebVisor establishes the underlying patterns among samples of the same malware families (e.g., families in terms of development tools). WebVisor focuses on C&C channels based on the Hypertext Transfer Protocol (HTTP). First, it builds clusters based on the statistical features of the HTTP-based Uniform Resource Locators (URLs) stored in the malware dataset. Then, it conducts a fine-grained, noise-agnostic clustering process, based on the structure and semantic features of the URLs. We present experimental results using a software prototype of WebVisor and real-world malware datasets.
AB - We present WebVisor, an automated tool to derive patterns from malware Command and Control (C&C) server connections. From collective network communications stored on a large-scale malware dataset, WebVisor establishes the underlying patterns among samples of the same malware families (e.g., families in terms of development tools). WebVisor focuses on C&C channels based on the Hypertext Transfer Protocol (HTTP). First, it builds clusters based on the statistical features of the HTTP-based Uniform Resource Locators (URLs) stored in the malware dataset. Then, it conducts a fine-grained, noise-agnostic clustering process, based on the structure and semantic features of the URLs. We present experimental results using a software prototype of WebVisor and real-world malware datasets.
UR - https://www.scopus.com/pages/publications/84942645359
U2 - 10.1007/978-3-319-18467-8_17
DO - 10.1007/978-3-319-18467-8_17
M3 - Conference contribution
AN - SCOPUS:84942645359
SN - 9783319184661
T3 - IFIP Advances in Information and Communication Technology
SP - 252
EP - 266
BT - ICT Systems Security and Privacy Protection - 30th IFIP TC 11 International Conference, SEC 2015, Proceedings
A2 - Gollmann, Dieter
A2 - Federrath, Hannes
PB - Springer New York LLC
T2 - 30th IFIP TC 11 International Information Security and Privacy Conference, SEC 2015
Y2 - 26 May 2015 through 28 May 2015
ER -