(2016) Kizzle: A Signature Compiler for Detecting Exploit Kits.
|
Text
kizzle.pdf - Published Version Download (1MB) | Preview |
Abstract
In recent years, the drive-by malware space has undergone significant consolidation. Today, the most common source of drive-by downloads are socalled exploit kits (EKs). This paper presents Kizzle, the first prevention technique specifically designed for finding exploit kits. Our analysis shows that while the JavaScript delivered by kits varies greatly, the unpacked code varies much less, due to the kits authors’ code reuse between versions. Ironically, this well-regarded software engineering practice allows us to build a scalable and precise detector that is able to quickly respond to superficial but frequent changes in EKs. Kizzle is able to generate anti-virus signatures for detecting EKs, which compare favorably to manually created ones. Kizzle is highly responsive and can generate new signatures within hours. Our experiments show that Kizzle produces high-accuracy signatures. When evaluated over a four-week period, false-positive rates for Kizzle are under 0.03%, while the false-negative rates are under 5%.
| Item Type: | Conference or Workshop Item (A Paper) (Paper) |
|---|---|
| Additional Information: | pub_id: 1007 Bibtex: stock_kizzle:16 URL date: None |
| Uncontrolled Keywords: | security |
| Divisions: | Michael Backes (InfSec) Ben Stock (Secure Web Applications Group, SWAG) |
| Conference: | DSN IEEE/IFIP International Conference on Dependable Systems and Networks |
| Depositing User: | Sebastian Weisgerber |
| Date Deposited: | 26 Jul 2017 10:30 |
| Last Modified: | 18 Jul 2019 12:10 |
| Primary Research Area: | NRA3: Threat Detection and Defenses |
| URI: | https://publications.cispa.saarland/id/eprint/544 |
Actions
Actions (login required)
 |
View Item |