2007 USENIX Annual Technical Conference
Pp. 233–246 of the Proceedings
Dynamic Spyware Analysis
Manuel Egele, Christopher Kruegel, and Engin Kirda, Secure Systems Lab, Technical University Vienna; Heng Yin, Carnegie Mellon University and College of William and Mary; Dawn Song, Carnegie Mellon University
Abstract
Spyware is a class of malicious code that is surreptitiously installed
on victims' machines. Once active, it silently monitors the behavior
of users, records their web surfing habits, and steals their
passwords.
Current anti-spyware tools operate in a way similar to traditional
virus scanners. That is, they check unknown programs against
signatures associated with known spyware instances. Unfortunately,
these techniques cannot identify novel spyware, require frequent
updates to signature databases, and are easy to evade by code
obfuscation.
In this paper, we present a novel dynamic analysis approach that
precisely tracks the flow of sensitive information as it is processed
by the web browser and any loaded browser helper objects. Using the
results of our analysis, we can identify unknown components as spyware
and provide comprehensive reports on their behavior. The techniques
presented in this paper address limitations of our previous work on
spyware detection and significantly improve the quality and richness
of our analysis. In particular, our approach allows a human analyst to
observe the actual flows of sensitive data in the system. Based on
this information, it is possible to precisely determine which
sensitive data is accessed and where this data is sent to.
To demonstrate the
effectiveness of the detection and the comprehensiveness of the
generated reports, we evaluated our system on a substantial body of
spyware and benign samples.
- View the full text of this paper in HTML and PDF. Listen to the presentation and Q & A in MP3 format.
Until June 2008, you will need your USENIX membership identification in order to access the full papers.
The Proceedings are published as a collective work, © 2007 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
|
