Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces

By Roberto Perdisci, Wenke Lee, N. Feamster. 2010

405 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Poisoning behavioral malware clustering (2014, background): “To expose these behavioral similarities, malware binaries are usually executed in a monitored sandbox environment, in order to identify malware families characterized by similar host-level events [e.g., 1, 3, 20, 27] or network traﬃc patterns [e.g., 13, 14, 24, 25].”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “Data Enhancement: [120] show that CPU emulation can accurately (DR=94%, FP=0%) spot polymorphic shellcode within network traffic; [118] demonstrate that polymorphic instances of HTTP-based malware can be accurately detected (DR=85.”
Practical Attacks Against Graph-based Clustering (2017, background): “Community discovery identifies criminal networks [39], connected components track malvertising campaigns [21], spectral clustering on graphs discovers botnet infrastructure [9, 20], hierarchical clustering identifies similar malware samples [11, 45], binary download graphs group potential malware do”
AVclass: A Tool for Massive Malware Labeling (2016, methodology): “…[2] 2007 Cluster 8.2K 5 Rieck et al. [28] 2008 Classify 10K 1 McBoost [23] 2008 Detect 5.5K 3 Bayer et al. [3] 2009 Cluster 75.7K 6 Perdisci et al. [24] 2010 Cluster+Detection 25.7K 3 Malheur [29] 2011 Cluster+Classify 3.1K 6 BitShred [13] 2011 Cluster 3.9K 40 Maggi et al. [18] 2011 Metrics 98.8K…”
Measuring Pay-per-Install: The Commoditization of Malware Distribution (2011, methodology): “In contrast to ex-M isting clustering systems for domain names [26], HTTP requests [25], and similar communication patterns [11], our system must accommodate any type of C&C, including custom binary protocols.”
Summoning Demons: The Pursuit of Exploitable Bugs in Machine Learning (2017, background): “These assumptions are realistic in many settings; for example, the machine learning techniques proposed for malware classiﬁcation or clustering [33, 28, 10, 31] operate on inputs that come from many sources, including possible adversaries.”
VAMO: towards a fully automated malware clustering validity analysis (2012, methodology): “Previous work did not present a comprehensive malware clustering validity analysis system, and the cohesion and separation validity indexes used in [15] were mainly internal validity indexes that required a signiﬁcant amount of interpretation through manual analysis.”
Scalable fine-grained behavioral clustering of HTTP-based malware (2013, methodology): “In this paper we make use of the DB index, and of the graph-based cohesion and separation validity indexes proposed in [31], which we briefly describe in Section 3.”
Building a Dynamic Reputation System for DNS (2010, background): “Such strategies would not be beneﬁcial for the FakeAV campaign, since domains like virus-scan1.com , virus-scan2.com , etc., can be trivially blocked by using simple regular expressions [16].”
The Role of Cloud Services in Malicious Software: Trends and Insights (2015, methodology): “[19], could be applied to refine the classification.”
A Comprehensive Review on Malware Detection Approaches (2020, unknown): “[67] previously reported in the literature.”