Detection of Intrusions and Malware, and Vulnerability Assessment: 4th International Conference, DIMVA 2007 Lucerne, Switzerland, July 12-13, 2007 Proceedings (Lecture Notes in Computer Science, 4579)

Title Page
Preface
Organization
Table of Contents
Extensible Web Browser Security
	Introduction
	Related Work
	A Malware Extension
	Our Approach to Enhance Security
		Extension Installation and Loading
		Install Protection Experimental Analysis
	Extension Execution
	Conclusion
	References
On the Effectiveness of Techniques to Detect Phishing Sites
	Introduction
	Related Work
	Scope of Study
	Experimental Setup
		Anti-phishing Solutions
		Test Data
	Study of Blacklist Effectiveness
	Study of Page Analysis Effectiveness
		Page Properties
		Classification Model
		Analysis of Internet Explorer Heuristics
	Conclusion
	References
Protecting the Intranet Against “JavaScript Malware” and Related Attacks
	Introduction
		Definitions
		Transparent Implicit Authentication
		Cross Site Request Forgery
	Attacking the Intranet with JavaScript
		Using a Webpage to Get Access to Restricted Web Resources
		A Closer Look at JavaScript
		Portscanning the Intranet
		Fingerprinting of Intranet Hosts
		Attacking Intranet Servers
		Leaking Intranet Content by Breaking DNS-Pinning
		Attacks That Do Not Rely on JavaScript
		Analysis
	Defense Strategies
		Turning Off Active Client-Side Technologies
		Extending the SOP to Single Elements
		Rerouting Cross-Site Requests
		Restricting the Local Network
		Comparison of the Proposed Protection Approaches
	Evaluation
		Implementation
		Practical Evaluation
		Limitations
	Related Work
	Conclusion and Future Work
	References
On the Effects of Learning Set Corruption in Anomaly-Based Detection of Web Defacements
	Introduction
	Related Work
	The Test Scenario: Web Site Defacement Detection
		Motivation and Framework
		Prototype Details
	Experiments
		Dataset
		Methodology
	Results
		Uncorrupted Learning Sequence
		Corrupted Learning Sequence
	A Corruption Detection Procedure
		Description
		Evaluation and Results
	Concluding Remarks
	References
Intrusion Detection as Passive Testing: Linguistic Support with TTCN-3
	Introduction
	Background - Reasoning About Behaviors
	The TTCN Language
	Motivation and Aims
	Case Study - Detecting $Smurf$ with TTCN-3
	Issues and Improvements
	Conclusions and Further Work
	References
Characterizing Bots’ Remote Control Behavior
	Introduction
	BotsandBotnets
		Bot Families and Variants
		Bot Capabilities and Commands
	Experimental Method
	Implementation
		Library and System Call Interposition
		Tainting Module
		User Input Module
		Behavior-Check Procedure
	Experimental Evaluation
		Bot Experiment Setup
		Terminology
		Bot Results
		Benign Program Results
		Performance Results
	Potential for Host-Based, Behavioral Bot Detection
	Related Work
	Conclusions
	References
Measurement and Analysis of Autonomous Spreading Malware in a University Environment
	Introduction
	Related Work
	Measurement Setup
	Analysis of Autonomous Spreading Malware
		Network-Based Analysis Results
		CWSandbox Analysis Results
		Antivirus Engines Detection Rates
		Botspy Analysis Results
	Conclusion and Future Work
	References
Passive Monitoring of DNS Anomalies
	Introduction
	Related Work
	Data Capture Methodology
	Results
		Collected Data
		Resource Record Type Prevalence
		Impact of Anti-spam Tools on the DNS System
		Typo Squatter Domains
		Fast Flux Domains
		Anomalous Records
		Record Reputation
	Conclusion and Future Work
	References
Characterizing Dark DNS Behavior
	Introduction
	Domain Name System
	Related Work
	Methodology
	DataAnalysis
		Basic Statistics
		Query Rate
		Query Targets
		Query Sources
	Discussion
		PTR Reconnaissance
		Validating Usefulness of PTR Reconnaissance
		Honeydns to Combat PTR Reconnaissance
	Conclusions and Future Work
	References
Distributed Evasive Scan Techniques and Countermeasures
	Introduction
	Classification of Scan Detection Methods and Evaluation Metrics
		Classification of Scan DetectionMethods
		EvaluationMetrics for Scan DetectionMethods
	z-Scan: Evasion Attacks Against TRW
		Naive Scan Against TRW
		z-Scan Against TRW
	Hybrid Detection Method and Evaluation
		Delayed Scan Against BSD
		Hybrid DetectionMethod
	Information-Hiding Countermeasures Against Evasion Techniques
	Related Work
	Conclusion
	References
On the Adaptive Real-Time Detection of Fast-Propagating Network Worms
	Introduction
	Related Work
	DataAnalysis
		Time Interval to Visit New Destinations
	RBS: Rate-Based Sequential Hypothesis Testing
	Evaluation
	Hybrid Approach: RBS+TRW
	Discussion
	Conclusion
	References
Targeting Physically Addressable Memory
	Introduction
		Roadmap
	Physically Addressable Memory Sources: libphysical
		Swapping, Multiple Accessors, Caching, Address Translation
		IEEE1394
		Filedescriptor: /dev/mem, Memory Dumps
		Other Sources
	Translating Virtual to Physical Addresses
		Example Implementation: IA-32 Backend for liblinear
		Finding Address Translation Tables
		Matching Via Statistics: NCD (Normalized Compression Distance)
	Attacking
		Information Gathering
		Userspace Modifications
	Future Prospects
		Kernelspace Modifications
		Bootstrapping Custom Operating Systems
	Conclusion
	References
Static Analysis on x86 Executables for PreventingAutomatic Mimicry Attacks
	Introduction
	Related Works
	Preliminaries
	Defeating Automatic Mimicry Attacks
		Defensive Strategy
	Effectiveness
		GOT Protection
		Code Pointers Protection
	Technical Details
		Static Analysis Tools
		Process Instrumentation
		int3 Exception Handling
	Experimental Results
	Conclusion and Future Works
	References
A Study of Malcode-Bearing Documents
	Introduction
	Background and Related Work
		Binary Content File Analysis
		Steganalysis
		Polymorphic Code Generation Tools
		Dynamic Sandbox Tests
	Statistical Analysis
		The POI Parser and SPARSEGui
		Statistical Content-Based Detection
		Performance Evaluation
		File Content Differences Identify Embedded Malcode
	Dynamic Run-Time Tests Using Environment Diversity
		Test 1 – OS Crashes
		Test 2 – Unexpected Changes to the Underlying Environment
		Test 3 – Non-fatal Application Errors
		Experiments and Analysis
	Conclusion
	References
Author Index