Ghost turns Zombie: Exploring the Life Cycle of Web-based Malware

LEET 2008 - 1st USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More

Volumn , Issue , 2008, Pages

  Polychronakis, Michalis ^a   Mavrommatis, Panayiotis ^b   Provos, Niels ^b  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b GOOGLE INC   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; COMPUTER VIRUSES; WEBSITES;

BOTNETS; DELIVERY VECTOR; E-MAIL ADDRESS; LIGHT WEIGHT; NETWORK BEHAVIORS; NETWORK PROFILES; WEB SERVERS; WEB-BASED MALWARE;

LIFE CYCLE;

EID: 85084094824     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. Google Safe Browsing API. http://code.google.com/apis/safebrowsing/.
2. K. G. Anagnostakis, S. Sidiroglou, P. Akritidis, K. Xinidis, E. Markatos, and A. D. Keromytis. Detecting Targeted Attacks Using Shadow Honeypots. August 2005.
3. J. Bem, G. Harik, J. Levenberg, N. Shazeer, and S. Tong. Large scale machine learning and methods. US Patent: 7222127.
4. M. Christodorescu, S. Jha, S. Seshia, D. Song, and R. Bryant. Semantics-aware malware detection. Security and Privacy, 2005 IEEE Symposium on, pages 32–46, 2005.
5. J. Dean and S. Ghemawat. Mapreduce: Simplified data processing on large clusters. In Proceedings of the Sixth Symposium on Operating System Design and Implementation, Dec 2004.
6. J. Franklin, V. Paxson, A. Perrig, and S. Savage. An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants. In Proceedings of the ACM Conference on Computer and Communications Security (CCS), October 2007.
7. A. Moser, C. Kruegel, and E. Kirda. Exploring multiple execution paths for malware analysis. Proc. IEEE Symposium on Security and Privacy, pages 231–245, 2007.
8. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of Internet background radiation. In Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement (IMC), pages 27–40, 2004.
9. N. Provos. A virtual honeypot framework. In Proceedings of the 12th USENIX Security Symposium, pages 1–14, August 2004.
10. N. Provos, P. Mavrommatis, M. A. Rajab, and F. Monrose. All Your iFrames Point To Us. Technical Report provos-2008a, Google Inc, 2008. http://research.google.com/archive/provos-2008a.pdf.
11. N. Provos, D. McNamee, P. Mavrommatis, K. Wang, and N. Modadugu. The ghost in the browser analysis of web-based malware. In Proceedings of the First Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.
12. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A Multifaceted Approach to Understanding the Botnet Phenomenon. In Proceedings of ACM SIGCOMM/USENIX Internet Measurement Conference (IMC), pages 41–52, Oct., 2006.
13. C. Willems, T. Holz, and F. Freiling. Toward Automated Dynamic Malware Analysis Using CWSandbox. Security & Privacy Magazine, IEEE, 5(2):32–39, 2007.
14. V. Yegneswaran, P. Barford, and D. Plonka. On the Design and Use of Internet Sinks for Network Abuse Monitoring. In Proceedings of the 7th International Symposium on Recent Advances In Intrusion Detection (RAID), September 2004.
15. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. In Proceedings of the 14th ACM Conference of Computer and Communication Security, October 2007.