Detecting malicious activities with user‐agent‐based profiles. (22nd July 2015)

• Record Type: Journal Article
• Authors: Zhang, Yang; Mekky, Hesham; Zhang, Zhi‐Li; Torres, Ruben; Lee, Sung‐Ju; Tongaonkar, Alok; Mellia, Marco; Sperotto, A.; Hofstede, R.; Dainotti, A.; Schmitt, C.; Dreo Rodosek, G.
• Is Part Of: International journal of network management. Volume 25:Number 5(2015:Sep./Oct.)
• Page Start: 306
• Page End: 319
• Publication Date: 2015-07-22
• Subjects: Computer networks -- Management -- Periodicals; 004.6
• DOI: 10.1002/nem.1900
• Languages: English
• ISSNs: 1055-7148

Abstract

<abstract abstract-type="main" id="nem1900-abs-0001"> <title>Summary</title> <p id="nem1900-para-0008">Hypertext transfer protocol (HTTP) has become the main protocol to carry out malicious activities. Attackers typically use HTTP for communication with command‐and‐control servers, click fraud, phishing and other malicious activities, as they can easily hide among the large amount of benign HTTP traffic. The user‐agent (UA) field in the HTTP header carries information on the application, operating system (OS), device, and so on, and adversaries fake UA strings as a way to evade detection. Motivated by this, we propose a novel <italic>grammar‐guided</italic> UA string classification method in HTTP flows. We leverage the fact that a number of 'standard' applications, such as web browsers and iOS mobile apps, have <italic>well‐defined</italic> syntaxes that can be specified using context‐free grammars, and we extract OS, device and other relevant information from them. We develop <italic>association</italic> heuristics to classify UA strings that are generated by 'non‐standard' applications that do not contain OS or device information. We provide a proof‐of‐concept system that demonstrates how our approach can be used to identify malicious applications that generate fake UA strings to engage in fraudulent activities. Copyright © 2015 John Wiley &amp; Sons, Ltd.</p> </abstract>