Exploiting visual appearance to cluster and detect rogue software

Authors:
Christian J. Dietrich;Christian Rossow;Norbert Pohlmann
Affiliations:
University of Applied Sciences Gelsenkirchen, Germany and University of Erlangen, Germany;University of Applied Sciences Gelsenkirchen, Germany and VU University Amsterdam, The Netherlands;University of Applied Sciences Gelsenkirchen, Germany
Venue:
Proceedings of the 28th Annual ACM Symposium on Applied Computing
Year:
2013

Citing 6
Cited 0

A case study of the rustock rootkit and spam bot

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
Botzilla: detecting the "phoning home" of malicious software

Proceedings of the 2010 ACM Symposium on Applied Computing
The nocebo effect on the web: an analysis of fake anti-virus distribution

LEET'10 Proceedings of the 3rd USENIX conference on Large-scale exploits and emergent threats: botnets, spyware, worms, and more
Behavioral clustering of HTTP-based malware and signature generation using malicious network traces

NSDI'10 Proceedings of the 7th USENIX conference on Networked systems design and implementation
An analysis of rogue AV campaigns

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
The underground economy of spam: a botmaster's perspective of coordinating large-scale spam campaigns

LEET'11 Proceedings of the 4th USENIX conference on Large-scale exploits and emergent threats

Quantified Score

Hi-index	0.00

Visualization

Abstract

Rogue software, such as Fake A/V and ransomware, trick users into paying without giving return. We show that using a perceptual hash function and hierarchical clustering, more than 213,671 screenshots of executed malware samples can be grouped into subsets of structurally similar images, reflecting image clusters of one malware family or campaign. Based on the clustering results, we show that ransomware campaigns favor prepay payment methods such as ukash, paysafecard and moneypak, while Fake A/V campaigns use credit cards for payment. Furthermore, especially given the low A/V detection rates of current rogue software -- sometimes even as low as 11% -- our screenshot analysis approach could serve as a complementary last line of defense.