ANALYSIS OF WEB-BASED BOT MALWARE INFECTION
description
Transcript of ANALYSIS OF WEB-BASED BOT MALWARE INFECTION
![Page 1: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/1.jpg)
Louena L. Manluctao
East Early College High School
Houston Independent School District
Dr. Guofei Gu Assistant Professor Department of
Computer Science & Engineering
Director, SUCCESS LAB
TEXAS A & M University
![Page 2: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/2.jpg)
EDUCATION
•Ph. D in Computer Science•Georgia Institute of Technology
•M.S. in Computer Science•Fudan University
![Page 3: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/3.jpg)
•Network and system security such as Internet malware detection, defense, and analysis
• Intrusion detection, anomaly detection
• Network security
• Web and social networking security
![Page 4: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/4.jpg)
Success Lab StudentsPhD
Seungwon Shin Chao Yang Zhaoyan Xu Jialong Zhang
MS Robert Harkreader Shardul Vikram Vijayasenthil VC Lingfeng Chen
Alumni Yimin Song (MS, first employment: Juniper Networks)
![Page 5: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/5.jpg)
Network & Web Security Botnet Analysis: Conficker Seungwon Shin and Guofei Gu.
"Conficker and Beyond: A Large-Scale Empirical Study." To appear in Proceedings of 2010 Annual Computer Security Applications Conference (ACSAC'10), Austin, Texasi, December 2010.
![Page 6: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/6.jpg)
Network & Web Security Botnet Analysis: Conficker Seungwon Shin, Raymond Lin, Guofei Gu.
"Cross-Analysis of Botnet Victims: New Insights and Implications." To appear in Proceedings of the 14th International Symposium on Recent Advances in Intrusion Detection (RAID 2011), Menlo Park, California, September 2011.
![Page 7: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/7.jpg)
Wireless Security Rogue Access Point Detection Yimin Song, Chao Yang, Guofei Gu. "Who
Is Peeping at Your Passwords at Starbucks? -- To Catch an Evil Twin Access Point." In Proceedings of the 40th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'10), Chicago, IL, June 2010
![Page 8: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/8.jpg)
Social Networking Website Security Twitter Spammer Accounts Detection Chao Yang, Robert Harkreader, Guofei Gu.
"Die Free or Live Hard? Empirical Evaluation and New Design for Fighting Evolving Twitter Spammers." To appear in Proceedings of the 14th International Symposium on Recent Advances in Intrusion Detection (RAID 2011), Menlo Park, California, September 2011.
![Page 9: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/9.jpg)
Malware Analysis Analysis of binary code and source
code Dynamic Analysis Static Analysis
Reverse Engineering Protocol Semanticis
![Page 10: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/10.jpg)
Intrusion and Detection System Enterprise Network Security Assist Us with computer terms
![Page 11: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/11.jpg)
The art of secret writing Converts data into unintelligible
(random looking) form Must be reversible (recover original
datawithout loss or modification)
![Page 12: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/12.jpg)
Plaintext: a message in its original form Ciphertext: a message in the transformed,
unrecognized form Encryption: the process that transforms a
plaintext into a ciphertext Decryption: the process that transforms a
ciphertext to the corresponding plaintext Key: the value used to control
encryption/decryption.
![Page 13: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/13.jpg)
Command Prompt.lnk
![Page 14: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/14.jpg)
![Page 15: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/15.jpg)
To Solve Practical Security Problems Internet malware detection, defense, and
analysis Intrusion detection, anomaly detections Network security Web and social networking security
To help society and country from threat of national security
![Page 16: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/16.jpg)
![Page 17: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/17.jpg)
Help researchers identify the type of responses that are most effective against botnets
Design Goals assist the defenders in identifying possible types of botnets
describe key properties of botnet classes
![Page 18: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/18.jpg)
•Estimate of overall utility. Measure the largest number of bots that can receive instructions and participate in an attack.
•Average amount of bandwidth that a bot can contribute, denoted by B.
![Page 19: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/19.jpg)
•Network diameter is one means of expressing this efficiency.
•This is the average geodesic length of a network.
![Page 20: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/20.jpg)
•Clustering coefficient measures the average degree of local transitivity.
•The transitivity measure index generally captures the robustness of a botnet
![Page 21: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/21.jpg)
•Random graphs are created to avoid creating predictable flows.•In a random graph, each node is connected with equal probability to the other N-1 nodes. •The chance that a bot has a degree of k is the binomial distribution:
![Page 22: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/22.jpg)
Acknowledgements
Texas A&M UniversityDr. Guofie Gu
Nuclear Power Institute
Texas Workforce Commission
National Science Foundation
Chevron
![Page 23: ANALYSIS OF WEB-BASED BOT MALWARE INFECTION](https://reader035.fdocuments.in/reader035/viewer/2022062315/56815b01550346895dc8b311/html5/thumbnails/23.jpg)
Wilber Rivas, Math Teacher, Del Rio High School
Chao Yang, Phd Student
Jialong Zhang, Phd Student