NoBot: Embedded malware detection for endpoint devices

Bell Labs Technical Journal

Volumn 16, Issue 1, 2011, Pages 155-170

  Menten, Lawrence E ^a   Chen, Aiyou ^a   Stiliadis, Dimitrios ^b  

^a LUCENT TECHNOLOGIES   (United States)

^b NOKIA RESEARCH CENTER   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTING RESOURCE; CONTROL PROCESSORS; DEEP PACKET INSPECTION; DEVICE DRIVER; DIGITAL SUBSCRIBER LINE ACCESS MULTIPLEXERS; ETHERNET SWITCHES; FALSE POSITIVE DETECTION; GIGABIT PASSIVE OPTICAL NETWORK; INTRUSION DETECTION AND PREVENTION SYSTEMS; LOW RATES; MALWARE DETECTION; MALWARES; OPEN SOURCES; PACKET CLASSIFICATION; RELIABLE DETECTION; SMART PHONES;

COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; DIGITAL DEVICES; ETHERS; FIBER OPTIC NETWORKS; OPEN SYSTEMS; OPTICAL SWITCHES; PACKET NETWORKS; TELECOMMUNICATION EQUIPMENT; TELEPHONE LINES; TELEPHONE SYSTEMS;

INTRUSION DETECTION;

EID: 79958207846     PISSN: 10897089     EISSN: 15387305     Source Type: Journal    
DOI: 10.1002/bltj.20492     Document Type: Article

References (20)

1. A. Chen, and, J. Cao, "Distinct Counting with a Self-Learning Bitmap," Proc. 25th IEEE Internat. Conf. on Data Eng. (ICDE '09) (Shanghai, Chn., 2009), pp. 1171-1174.
2. J. R. Crandall, R. Ensafi, S. Forrest, J. Ladau, and, B. Shebaro, "The Ecology of Malware," Proc. New Security Paradigms Workshop (NSPW '08) (Lake Tahoe, CA, 2008), pp. 99-106.
3. C. R. Davis, S. Neville, J. M. Fernandez, J.-M. Robert, and, J. McHugh, "Structured Peer-to-Peer Overlay Networks: Ideal Botnets Command and Control Infrastructures?," Proc. 13th Eur. Symp. on Res. in Comput. Security (ESORICS '08) (Malaga, Sp., 2008), pp. 461-480.
4. C. Estan, G. Varghese, and, M. Fisk, "Bitmap Algorithms for Counting Active Flows on High Speed Links," Proc. 3rd ACM SIGCOMM Internet Measurement Conf. (IMC '03) (Miami Beach, FL, 2003), pp. 153-166. (Pubitemid 40730647)
5. M. Fratto, "Rolling Review: Alcatel-Lucent OmniSwitch," InformationWeek, Aug. 9, 2008, < http://www.informationweek.com/news/ infrastructure/showArticle.jhtml?articleID=209903837>.
6. A. Gonsalves, "McAfee Bug Forces Massive PC Cleanup," InformationWeek, Apr. 22, 2010, < http://www.informationweek.com/news/ software/app-optimization/showArticle.jhtml?articleID=224600157>.
7. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and, W. Lee, "BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation," Proc. 16th USENIX Security Symp. (SS '07) (Boston, MA, 2007), pp. 167-182.
8. T. Holz, C. Gorecki, K. Rieck, and, F. C. Freiling, "Measuring and Detecting Fast-Flux Service Networks," Proc. 16th Annual Network and Distrib. Syst. Security Symp. (NDSS '08) (San Diego, CA, 2008), session 6.
9. The Honeynet Project, "Know Your Enemy: Fast Flux Service Networks," July 13, 2007, < http://www.honeynet.org/papers/ff>.
10. J. P. John, A. Moshchuk, S. D. Gribble, and, A. Krishnamurthy, "Studying Spamming Botnets Using Botlab," Proc. 6th USENIX Symp. on Networked Syst. Design and Implementation (NSDI '09) (Boston, MA, 2009), pp. 291-306.
11. J. Kirk, "Microsoft Recruited Top-Notch Security Guns for Waledac Takedown," IDG News Service, Feb. 25, 2010, < http://www.networkworld. com/news/2010/022510-microsoft-recruited-top-notch-guns.html>.
12. R. Lemos, "ISPs Under Pressure to Crack Down on Bots and Spam," DarkReading, June 9, 2010, < http://www.darkreading.com/securityservices/ 167801101/security/client-security/225600129/isps-under-pressure-to-crack-down- on-bots-and-spam.html>.
13. J. Markoff, "Defying Experts, Rogue Computer Code Still Lurks," New York Times, Aug. 26, 2009, < http://www.nytimes.com/2009/08/27/ technology/27compute.html>.
14. "KHOBE - 8.0 Earthquake for Windows Desktop Security Software," May 5, 2010, < http://www.matousec.com/info/articles/khobe-8.0-earthquake- for-windowsdesktop-security-software.php>.
15. R. McMillan, "Nasty Banking Trojan Makes Mules of Victims," IDG News Service, Oct. 5, 2009, < http://www.networkworld.com/news/2009/100609- nasty-banking-trojanmakes-mules.html>.
16. E. Passerini, R. Paleari, L. Martignoni, and, D. Bruschi, "FluXOR: Detecting and Monitoring Fast-Flux Service Networks," Proc. 5th Internat. Conf. on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA '08) (Paris, Fra., 2008), pp. 186-206.
17. M. Richard, "Intrusion Detection FAQ: Are There Limitations of Intrusion Signatures?," SANS Institute, Apr. 5, 2001, < http://www.sans.org/security-resources/idfaq/limitations.php>.
18. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and, G. Vigna, "Your Botnet is My Botnet: Analysis of a Botnet Takeover," Proc. 16th ACM Conf. on Comput. and Commun. Security (CCS '09) (Chicago, IL, 2009), pp. 635-647.
19. G. Tenebro, "Waledac, Part 2: Its Bootstraps and Armor," Symantec Connect, Aug. 14, 2009, < http://www.symantec.com/connect/blogs/ waledac-part-2-its-bootstraps-andarmor>.
20. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and, I. Osipkov, "Spamming Botnets: Signatures and Characteristics," Proc. ACM SIGCOMM Conf. on Data Commun. (SIGCOMM '08) (Seattle, WA, 2008), pp. 171-182.