Abstract-HTTP is a popular channel for malware to communicate with malicious servers (e.g., Command & Control, drive-by download, drop-zone), as well as to attack benign servers. By utilizing HTTP requests, malware easily disguises itself under a large amount of benign HTTP traffic. Thus, identifying malicious HTTP activities is challenging. We leverage an insight that cyber criminals are increasingly using dynamic malicious infrastructures with multiple servers to be efficient and anonymous in (i) malware distribution (using redirectors and exploit servers), (ii) control (using C&C servers) and (iii) monetization (using payment servers), and (iv) being robust against server takedowns (using multiple backups for each type of servers). Instead of focusing on detecting individual malicious domains, we propose a complementary approach to identify a group of closely related servers that are potentially involved in the same malware campaign, which we term as Associated Server Herd (ASH). Our solution, SMASH (Systematic Mining of Associated Server Herds), utilizes an unsupervised framework to infer malware ASHs by systematically mining the relations among all servers from multiple dimensions. We build a prototype system of SMASH and evaluate it with traces from a large ISP. The result shows that SMASH successfully infers a large number of previously undetected malicious servers and possible zero-day attacks, with low false positives. We believe the inferred ASHs provide a better global view of the attack campaign that may not be easily captured by detecting only individual servers. Malware is a critical security threat to the Internet. Malware is increasingly using HTTP as its communication and attacking channel due to the following reasons: (i) HTTP is allowed in most networks, and thus malware has a good chance to infect victims and communicate with attackers. (ii) Since HTTP now is the majority of network traffic, malware can easily disguise its activities under huge benign HTTP traffic, making it difficult to be detected. (iii) Most HTTP requests use domain names to find servers, thus malware can easily evade IP blocking or hide their servers by using Fast-Flux [25] . As a result, 75 % of malware is observed to generate HTTP traffic [28] , and the number of Web-based attacks increased by almost three-fold since 2012 [9] . Given the severity and popularity of HTTP based malware, we focus on such threats. In particular, we concentrate on detecting malicious HTTP activities from the server side communication perspective. 1 We define two types of mali-
Zhang et al. REF employed unsupervised technique to identify the group of related severs that are likely to be involved in the same malware campaign.
Systematic Mining of Associated Server Herds for Malware Campaign Discovery
2015 IEEE 35th International Conference on Distributed Computing Systems
2015 IEEE 35th International Conference on Distributed Computing Systems
Computer Science