DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting

Riccardo  Bortolameotti; Thijs Sebastiaan van Ede; Marco Caselli; Maarten Hinderik Everts; Pieter H. Hartel; Rick Hofstede; Willem  Jonker; Andreas  Peter

doi:10.1145/3134600.3134605

DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting

Riccardo Bortolameotti, Thijs Sebastiaan van Ede, Marco Caselli, Maarten Hinderik Everts, Pieter H. Hartel, Rick Hofstede, Willem Jonker, Andreas Peter

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

31 Citations (Scopus)

8 Downloads (Pure)

Abstract

We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype with realistic data from an international organization and datasets composed of malicious traffic. We show that our system achieves a false positive rate of 0.9% for 441 monitored host machines, an average detection rate of 97.7%, and that it cannot be evaded by malware using simple evasion techniques such as using known browser user agent values. We compare our solution with DUMONT [24], the current state-of-the-art IDS which detects HTTP covert communication channels by focusing on benign HTTP traffic. The results show that DECANTeR outperforms DUMONT in terms of detection rate, false positive rate, and even evasion-resistance. Finally, DECANTeR detects 96.8% of information stealers in our dataset, which shows its potential to detect data exfiltration.

Original language	English
Title of host publication	ACSAC 2017, Proceedings of the 33rd Annual Computer Security Applications Conference
Pages	373-386
ISBN (Electronic)	978-1-4503-5345-8
DOIs	https://doi.org/10.1145/3134600.3134605
Publication status	Published - 2017
Event	33nd Annual Computer Security Applications Conference 2017 - Orlando, United States Duration: 4 Dec 2017 → 8 Dec 2017 Conference number: 33 https://www.acsac.org

Conference

Conference	33nd Annual Computer Security Applications Conference 2017
Abbreviated title	ACSAC 2017
Country/Territory	United States
City	Orlando
Period	4/12/17 → 8/12/17
Internet address	https://www.acsac.org

Access to Document

10.1145/3134600.3134605

Cite this

@inproceedings{41ceea25628048d9b1d33d86ca0df6db,

title = "DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting",

abstract = "We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype with realistic data from an international organization and datasets composed of malicious traffic. We show that our system achieves a false positive rate of 0.9% for 441 monitored host machines, an average detection rate of 97.7%, and that it cannot be evaded by malware using simple evasion techniques such as using known browser user agent values. We compare our solution with DUMONT [24], the current state-of-the-art IDS which detects HTTP covert communication channels by focusing on benign HTTP traffic. The results show that DECANTeR outperforms DUMONT in terms of detection rate, false positive rate, and even evasion-resistance. Finally, DECANTeR detects 96.8% of information stealers in our dataset, which shows its potential to detect data exfiltration.",

author = "Riccardo Bortolameotti and {van Ede}, {Thijs Sebastiaan} and Marco Caselli and Everts, {Maarten Hinderik} and Hartel, {Pieter H.} and Rick Hofstede and Willem Jonker and Andreas Peter",

year = "2017",

doi = "10.1145/3134600.3134605",

language = "English",

pages = "373--386",

booktitle = "ACSAC 2017, Proceedings of the 33rd Annual Computer Security Applications Conference",

note = "33nd Annual Computer Security Applications Conference 2017 , ACSAC 2017 ; Conference date: 04-12-2017 Through 08-12-2017",

url = "https://www.acsac.org",

}

Bortolameotti, R, van Ede, TS, Caselli, M, Everts, MH, Hartel, PH, Hofstede, R, Jonker, W & Peter, A 2017, DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting. in ACSAC 2017, Proceedings of the 33rd Annual Computer Security Applications Conference. pp. 373-386, 33nd Annual Computer Security Applications Conference 2017 , Orlando, Florida, United States, 4/12/17. https://doi.org/10.1145/3134600.3134605

DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting. / Bortolameotti, Riccardo ; van Ede, Thijs Sebastiaan; Caselli, Marco et al.
ACSAC 2017, Proceedings of the 33rd Annual Computer Security Applications Conference. 2017. p. 373-386.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - DECANTeR: DEteCtion of Anomalous outbouNd HTTP TRaffic by Passive Application Fingerprinting

AU - Bortolameotti, Riccardo

AU - van Ede, Thijs Sebastiaan

AU - Caselli, Marco

AU - Everts, Maarten Hinderik

AU - Hartel, Pieter H.

AU - Hofstede, Rick

AU - Jonker, Willem

AU - Peter, Andreas

N1 - Conference code: 33

PY - 2017

Y1 - 2017

N2 - We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype with realistic data from an international organization and datasets composed of malicious traffic. We show that our system achieves a false positive rate of 0.9% for 441 monitored host machines, an average detection rate of 97.7%, and that it cannot be evaded by malware using simple evasion techniques such as using known browser user agent values. We compare our solution with DUMONT [24], the current state-of-the-art IDS which detects HTTP covert communication channels by focusing on benign HTTP traffic. The results show that DECANTeR outperforms DUMONT in terms of detection rate, false positive rate, and even evasion-resistance. Finally, DECANTeR detects 96.8% of information stealers in our dataset, which shows its potential to detect data exfiltration.

AB - We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype with realistic data from an international organization and datasets composed of malicious traffic. We show that our system achieves a false positive rate of 0.9% for 441 monitored host machines, an average detection rate of 97.7%, and that it cannot be evaded by malware using simple evasion techniques such as using known browser user agent values. We compare our solution with DUMONT [24], the current state-of-the-art IDS which detects HTTP covert communication channels by focusing on benign HTTP traffic. The results show that DECANTeR outperforms DUMONT in terms of detection rate, false positive rate, and even evasion-resistance. Finally, DECANTeR detects 96.8% of information stealers in our dataset, which shows its potential to detect data exfiltration.

U2 - 10.1145/3134600.3134605

DO - 10.1145/3134600.3134605

M3 - Conference contribution

SP - 373

EP - 386

BT - ACSAC 2017, Proceedings of the 33rd Annual Computer Security Applications Conference

T2 - 33nd Annual Computer Security Applications Conference 2017

Y2 - 4 December 2017 through 8 December 2017

ER -