2018

Analysis of Botnet Behavior as a Distributed System

Analysis of Botnet Behavior as a Distributed System

El crecimiento vertiginoso de nuevas tecnologıas, trae aparejado el crecimiento de aplicaciones maliciosas. Estas aplicaciones hacen uso de los recursos de los dispositivos infectados para realizar actividades ilıcitas, enviar mails de forma masiva (spam) o minar para obtener criptomonedas. Para minar, se requiere grandes capacidades de cómputo Las botnets pueden ser consideradas como un tipo de de aplicación de computación distribuıda. La palabra botnet significa red de robots. Es un tipo de malware, instalado en una computadora que ha sido infectada, con la habilidad de auto propagarse hacia otras máquinas. Todas las computadoras infectadas conforman la “red de bots”, o botnet. Este tipo de malware utiliza los recursos de la computadora infectad (CPU, RAM, ancho de banda), para comunicarse con su Botnet Master, que es quien le da órdenes. El presente trabajo es un estado del arte, se analiza el comportamiento de las botnets como aplicaciones de computación distribuıda. Se considera el comportamiento a nivel de consumo de recursos de los dispositivos que son infectados por el malware, en particular los miners.

An Analysis of Convolutional Neural Networks for detecting DGA

A Domain Generation Algorithm (DGA) is an algorithm to generate domain names in a deterministic but seemly random way. Malware use DGAs to generate the next domain to access the Command Control (C&C) communication channel. Given the simplicity and velocity associated to the domain generation process, machine learning detection methods emerged as suitable detection solution. However, since the periodical retraining becomes mandatory, a fast and accurate detection method is needed. Convolutional neural network (CNN) are well known for performing real-time detection in fields like image and video recognition. Therefore, they seem suitable for DGA detection. The present work is a preliminary analysis of the detection performance of CNN for DGA detection. A CNN with a minimal architecture complexity was evaluated on a dataset with 51 DGA malware families as well as normal domains. Despite its simple architecture, the resulting CNN model correctly detected more than 97% of total DGA domains with a false positive rate close to 0.7%.

Bringing a GAN to a Knife-Fight: Adapting Malware Communication to Avoid Detection.

Generative Adversarial Networks (GANs) have been successfully used in a large number of domains. This paper proposes the use of GANs for generating network traffic in order to mimic other types of traffic. In particular, our method modifies the network behavior of a real malware in order to mimic the traffic of a legitimate application, and therefore avoid detection. By modifying the source code of a malware to receive parameters from a GAN, it was possible to adapt the behavior of its Command and Control (C2) channel to mimic the behavior of Facebook chat network traffic. In this way, it was possible to avoid the detection of new-generation Intrusion Prevention Systems that use machine learning and behavioral characteristics. A real-life scenario was successfully implemented using the Stratosphere behavioral IPS in a router, while the malware and the GAN were deployed in the local network of our laboratory, and the C2 server was deployed in the cloud. Results show that a GAN can successfully modify the traffic of a malware to make it undetectable. The modified malware also tested if it was being blocked and used this information as a feedback to the GAN. This work envisions the possibility of self-adapting malware and self-adapting IPS.

Arming Malware with GANs

Generative Adversarial Networks (GANs) are a recent invention that shows impressive results in generating completely new images of faces, building interiors and much more. In this talk we present how we can use GANs to modify network traffic parameters in order to mimic other types of traffic. More specifically, we modify an open source malware to use a GAN to dynamically adapt its Command and Control network behavior and mimic the traffic characteristics of Facebook chat. In this way it is able to avoid the detection from new-generation Intrusion Prevention Systems that use behavioral characteristics. We will present our experiments from a real-life scenario that used the Stratosphere behavioral IPS deployed in a router between the malware which was deployed in our lab and the C&C server deployed in AWS. Results show that it is possible for the malware to become undetected when given the input parameters from a GAN. The malware is also aware of whether or not it is being blocked and uses this as a feedback signal in order to improve the GAN model. Finally, we discuss the implications of this work in malware detection as well as other areas such as censorship circumvention.

Protecting the civil society through high quality research