NetGator: malware detection using program interactive challenges

摘要: Internet-borne threats have evolved from easy to detect denial of service attacks zero-day exploits used for targeted exfiltration data. Current intrusion detection systems cannot always keep-up with and it is often the case that valuable data already been communicated an external party over encrypted or plain text connection before detected. In this paper, we present a scalable approach called Network Interrogator (NetGator) network-based malware attempts exfiltrate open ports protocols. NetGator operates as transparent proxy using protocol analysis first identify declared client application known network flow signatures.Then craft packets "challenge" by exercising functionality in legitimate applications but too complex intricate be malware. When unable correctly solve respond challenge, flags potential Our seamless requires no interaction user changes on commodity software. introduces minimal traffic latency (0.35 seconds average) normal communication while can expose wide-range existing threats.