Botzilla: detecting the "phoning home" of malicious software

  • Authors:

  • Konrad Rieck;Guido Schwenk;Tobias Limmer;Thorsten Holz;Pavel Laskov

  • Affiliations:

  • Berlin Institute of Technology, Berlin, Germany;Fraunhofer Institute FIRST, Berlin, Germany;University of Erlangen, Erlangen, Germany;Technical University of Vienna, Vienna, Austria;University of Tübingen, Tübingen, Germany

  • Venue:
  • Proceedings of the 2010 ACM Symposium on Applied Computing
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Hosts infected with malicious software, so called malware, are ubiquitous in today's computer networks. The means whereby malware can infiltrate a network are manifold and range from exploiting of software vulnerabilities to tricking a user into executing malicious code. Monitoring and detection of all possible infection vectors is intractable in practice. Hence, we approach the problem of detecting malicious software at a later point when it initiates contact with its maintainer; a process referred to as "phoning home". In particular, we introduce Botzilla, a method for detection of malware communication, which proceeds by repetitively recording network traffic of malware in a controlled environment and generating network signatures from invariant content patterns. Experiments conducted at a large university network demonstrate the ability of Botzilla to accurately identify malware communication in network traffic with very low false-positive rates.