6th European Conference - Academic Conferences

Madhu Shankarapani and Srinivas Mukkamala
network. Using JavaScript, it generates pseudo-random domain name on-the-fly and redirects victims
to a malicious webpage.
Vundo, also known as VirtuMundo, VirtuMonde, and MS Juan, spreads via email, peer-to-peer file
sharing, and by other malware (Bell and Chien, 2010). It exploits browser vulnerability and displays
pop-up advertisements. This Trojan has capabilities to inject advertisements into search results.
Fraudulent or misleading applications, intrusive pop-ups, fake scan results are characteristics of this
Trojan. Vundo lowers security settings, prevents access to certain websites, and also disables
antivirus programs, to make it further difficult to remove them. Its new variants are far more
sophisticated with their payloads and its functionality. They have the capability to exploit vulnerability
to download misleading software, and extensions that encrypt files in order to force user for money.
Zeus is a Trojan horse that steals banking information from infected machines, which spreads using
drive-by-downloads and phishing emails. Since from the date it was first identified, Zeus has been
very active in the wild with constant increase in threat. The most threatening is a large group working
on Zeus to create enormous Zeus/Zbot variants builder, which can evade the present anti-virus
software.
The problem is so critical, that a significant research effort has been invested to gain a better
understanding of these malware characteristics. One of the approaches to study the characteristics is
to perform passive analysis of secondary effects that are caused by the activities of compromised
hosts. Many researchers have performed passive analysis like collecting spam emails that are likely
to be sent by bots (Zhuang et al, 2008), DNS queries (Rajab et al, 2007), (Rajab et al, 2006) or DNS
blacklist queries (Ramachandran, Feamster and Dagon, 2006) performed by the bot-infected
machines, analysis of network traffic for cues that are characteristics for certain botnets (Karasaridis,
Rexroad and Hoeflin, 2007).
While these analysis provides interesting insights into particular characteristics of Trojans and bots, its
approach is limited to those botnets that actually exhibit the activity targeted by the analysis. Active
approaches to analyze botnets are through permeation. In this approach researchers join the bot to
perform analysis. Usually honeypots or spam traps are used to collect a copy of a malware sample.
Later, the obtained samples are executed in controlled environment and observe its behavior.
Observations include traffic that is exchanged between bots and its command and control server(s),
IP addresses of other clients that are concurrently logged into the IRC channel (Rajab et al, 2006),
(Cooke, Jahanian and McPherson, 2006), (Freiling, Holz and Wicherski, 2005). Unfortunately these
techniques do not work on stripped-down IRC or HTTP servers as their C&C channels.
Present anti-virus techniques are based on either signature-based detection which is not effective
against polymorphic and unknown malware, or heuristic-based algorithms which are inefficient and
inaccurate. Detection based on string signatures uses a database of regular expressions and a string
matching engine to scan files and detect infected ones. Each regular expression of the database is
designed to identify a known malicious program. Though traditional signature-based malware
detection methods does exists from ages, there are lots to improve the signature-based detection and
to detect new malware a few data mining and machine learning techniques are proposed (Westfeld,
2001: 289-302), (Sallee, 2005: 167-189), (Solanki, Sarkar and Manjunath, 2007: 16-31) examined the
performance of various classifiers such as Naïve Bayes, support vector machine (SVM) and plotting
ROC curves using decision tree methods. (Lyu, and Farid, 2002: 340-354) applied Objective-Oriented
Association (OOA) mining based classification (Fridrich, 2004: 67-81), (Shi, Chen and Chen, 2006) on
Windows API execution sequences called by PE files. A Few of these methods entirely rely on the
occurrence of API sequence of execution. There are methods where websites are crawled to inspect
if those websites host any kind of malicious executables (Pevny, Fridrich, 2007). This study is
generally for web server security, advertising and third-party widgets. Their basic idea of approach
shows how malware executables are often distributed across a large number of URLs and domains.
Analyze and detect these obfuscated malicious executable is by itself a vast field.
Our work is based on collection of Zeus/Zbot variants collected at Offensive Computing (Offensive
Computing, 2010). As of today, Offensive Computing has one of the largest malware databases which
include various kinds of executables like spyware, adware, virus, worms, Trojans, etc. Among
thousands of malware in computing world, the unique executables is likely to be much lower as many
253