Dec. 5, 2005 to Dec. 9, 2005
Weidong Cui , University of California, Berkeley and Hewlett-Packard Laboratories
Randy H. Katz , University of California, Berkeley and Hewlett-Packard Laboratories
Wai-tian Tan , University of California, Berkeley and Hewlett-Packard Laboratories
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/CSAC.2005.19
An increasing variety of malware, such as worms, spyware and adware, threatens both personal and business computing. Remotely controlled bot networks of compromised systems are growing quickly. In this paper, we tackle the problem of automated detection of break-ins caused by unknown malware targeting personal computers. We develop a host based system, BINDER (Break-IN DEtectoR), to detect break-ins by capturing user unintended malicious outbound connections (referred to as extrusions). To infer user intent, BINDER correlates outbound connections with user-driven input at the process level under the assumption that user intent is implied by user-driven input. Thus BINDER can detect a large class of unknown malware such as worms, spyware and adware without requiring signatures. We have successfully used BINDER to detect real world spyware on daily used computers and email worms on a controlled testbed with very small false positives.
Weidong Cui, Randy H. Katz, Wai-tian Tan, "Design and Implementation of an Extrusion-based Break-In Detector for Personal Computers", ACSAC, 2005, Computer Security Applications Conference, Annual, Computer Security Applications Conference, Annual 2005, pp. 361-370, doi:10.1109/CSAC.2005.19