Malicons: Detecting Payload in Favicons

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F16%3A00243142" target="_blank" >RIV/68407700:21230/16:00243142 - isvavai.cz</a>
Alternative codes found
RIV/68407700:21240/16:00243142
Result on the web
<a href="http://ist.publisher.ingentaconnect.com/contentone/ist/ei/2016/00002016/00000008/art00015" target="_blank" >http://ist.publisher.ingentaconnect.com/contentone/ist/ei/2016/00002016/00000008/art00015</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.2352/ISSN.2470-1173.2016.8.MWSF-079" target="_blank" >10.2352/ISSN.2470-1173.2016.8.MWSF-079</a>

Result language
angličtina
Original language name
Malicons: Detecting Payload in Favicons
Original language description
A recent version of the "Vawtrak" malware used steganography to hide the addresses of the command and control channels in favicons: small images automatically downloaded by the web browser. Since almost all research in steganalysis focuses on natural images, we study how well these methods can detect secret messages in favicons. The study is performed on a large corpus of favicons downloaded from the internet and applies a number of state-of-art steganalysis techniques, as well as proposing very simple novel features that exploit flat areas in favicons. The ultimate question is whether we can detect Vawtrak's steganographic favicons with a sufficiently low false positive rate.
Czech name
—
Czech description
—

Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Publication year
2016
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Similar results(10)