Journal of Emerging Technologies in Web Intelligence Contents

154 JOURNAL OF EMERGING TECHNOLOGIES IN WEB INTELLIGENCE, VOL. 2, NO. 2, MAY 2010now enter via the Web and IBM Internet Security Systems(ISS) estimates that nearly 100% of Web attacks nowutilize obfuscated JavaScript as a very effective techniqueto bypass antivirus and intrusion prevention.Today, once a PC is infected with stealth malware, ittypically opens two-way communications to a “commandand control” (C&C) server to establish a channel back tothe cyber criminal. This allows the “bot” (as in “robotcomputer”) to report status as well as any valuableinformation that is immediately accessible. Groups ofthese remotely controlled, malware-infected computersare commonly called botnets, and serve as the foundationof most cybercrime on the Internet.How do victims get infected? A user may be drawn bya phishing e-mail to a Web site hosted on a hijackedserver, which serves up a browser exploit; this downloadsand installs a bot on the user’s PC. The bot thendownloads more malware like “keyloggers” that silentlyrecord keyboard and mouse activities to execute furthercriminal activities, such as stealing user credentials andcapturing other sensitive information. All of this takesplace without the knowledge of the user or administrator.As their prevalence has increased, remote-controlmalware/botnets have become serious concerns forsecurity administrators.The recent January, 2009 malware-related data thefts atHeartland Payment Systems and earlier malwareRecent Research[14] Has Found:11 % of the world’s computers are enmeshed in at leastone botnet23 % of home computers become infected despite havingsecurity enabled72 % of corporate networks larger than 100 PC’s have aninfectioninfiltrations at Hannaford Supermarkets, University ofFlorida Medical Center, and NASA underscore theescalating threat of malware-related data breaches. TheIdentity Theft Resource Center, a nonprofit group focusedon understanding and preventing identity theft, reportedthat 656 known security breaches had taken place in 2008,reflecting a 47 percent increase over 2007’s total. As ofMarch 17, 2009 the resource center had already reported110 breaches in 2009.V. STEALTH MALWARE ATTACKS ARE OUTMANEUVERINGCONVENTIONAL DEFENSESDefending corporate networks from today’s malwarerelateddata thefts requires modern protection that goesbeyond current signature- and heuristic-based detectiontechniques. Modern threats exploit the inability ofconventional network protection to provide a unifieddefense against a criminal who attacks on multiple fronts,from OS and browser vulnerabilities to social engineering.The anachronistic concept of detecting infections with asingle technique, such as signatures, has left manybusinesses and consumers open to attack, despite theirdeployment of antivirus and IPS (intrusion preventionsystems). The sheer volume and escalating danger ofmodern attacks are overwhelming limited IT resourcesand outmaneuvering conventional defenses that mayalready be in place. To enable a more efficient IT securityprocess, accurate and timely identification of infectedmachines is the first step in preventing malware-relateddata breaches. And, the only viable solutions are thosethat provide thorough coverage across the many vectorsthat are used in attacks.VI. CONVENTIONAL APPROACHES FAIL TO PROTECTAGAINST WEB THREATSWeb threat scanning has specific requirements that arenot met by the traditional approach to virus scanning.Conventional antivirus software installed on clientmachines, for example, while crucial to the protection ofthese machines from a variety of threats, does notadequately protect against the evolving set of Web threats.One reason is that the conventional approach to virusprotection involves collecting samples of viruses,developing patterns, and quickly distributing thesepatterns to users. Because many Web threats are targetedattacks and span many variants, collecting samples isalmost impossible.The large numbers of variants use multiple deliveryvehicles (for example, spam, instant messaging, and Websites), rendering the conventional sample collection,pattern creation, and deployment process insufficient.Another reason that conventional virus detectionprocesses fall short involves a fundamental differencebetween these viruses and evolving Web threats.Conventional viruses were fundamentally designed tospread as quickly as possible, and were therefore ofteneasy to spot. With the advent of Web threats, malware hasevolved from this outbreak model to stealthy “sleeper”infections that are therefore difficult to detect viaconventional antivirus techniques.Recovering from infections also presents newchallenges. In some cases, Web threats may result in asystem infection that is so extensive (for example, via arootkit in which the system file is replaced) thatconventional uninstall or system cleaning approachesbecome useless. Infected systems often require a completesystem recovery, in which the hard drive is wiped and theoperating system, applications, and user data arereinstalled.VII. FUTURE WORKA New Approach Is Needed: Integrated, Multi-Layered Protection - Clearly, users need a newapproach to addressing Web threats that complementsexisting techniques.The most effective approach willemploy multiple layers of protection and incorporate arange of protective measures. In addition, the evolvingnature of the threat necessitates some form of informationfeedback and integration, in which information gatheredin one portion of the protection network is used to updateinformation in other layers. Any effective approach© 2010 ACADEMY PUBLISHER