Observer Effect: How Intercepting HTTPS Traffic Forces Malware to Change Their Behavior

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F18%3A00318870" target="_blank" >RIV/68407700:21230/18:00318870 - isvavai.cz</a>

Výsledek na webu

<a href="https://link.springer.com/chapter/10.1007/978-3-319-75214-3_26#Sec1" target="_blank" >https://link.springer.com/chapter/10.1007/978-3-319-75214-3_26#Sec1</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1007/978-3-319-75214-3_26" target="_blank" >10.1007/978-3-319-75214-3_26</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Observer Effect: How Intercepting HTTPS Traffic Forces Malware to Change Their Behavior

Popis výsledku v původním jazyce

During the last couple of years there has been an important surge on the use of HTTPs by malware. The reason for this increase is not completely understood yet, but it is hypothesized that it was forced by organizations only allowing web traffic to the Internet. Using HTTPs makes malware behavior similar to normal connections. Therefore, there has been a growing interest in understanding the usage of HTTPs by malware. This paper describes our research to obtain large quantities of real malware traffic using HTTPs, our use of man-in-the-middle HTTPs interceptor proxies to open and study the content, and our analysis of how the behavior of the malware changes after being intercepted. The research goal is to understand how malware uses HTTPs and the impact of intercepting its traffic. We conclude that the use of an interceptor proxy forces the malware to change its behavior and therefore should be carefully considered before being implemented.

Název v anglickém jazyce

Observer Effect: How Intercepting HTTPS Traffic Forces Malware to Change Their Behavior

Popis výsledku anglicky

During the last couple of years there has been an important surge on the use of HTTPs by malware. The reason for this increase is not completely understood yet, but it is hypothesized that it was forced by organizations only allowing web traffic to the Internet. Using HTTPs makes malware behavior similar to normal connections. Therefore, there has been a growing interest in understanding the usage of HTTPs by malware. This paper describes our research to obtain large quantities of real malware traffic using HTTPs, our use of man-in-the-middle HTTPs interceptor proxies to open and study the content, and our analysis of how the behavior of the malware changes after being intercepted. The research goal is to understand how malware uses HTTPs and the impact of intercepting its traffic. We conclude that the use of an interceptor proxy forces the malware to change its behavior and therefore should be carefully considered before being implemented.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

20201 - Electrical and electronic engineering

Projekt

—

Návaznosti

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Rok uplatnění

2018

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Computer Science - CACIC 2017

ISBN

978-3-319-75213-6

ISSN

1865-0929

e-ISSN

—

Počet stran výsledku

10

Strana od-do

272-281

Název nakladatele

Springer International Publishing

Místo vydání

Cham

Místo konání akce

Buenos Aires

Datum konání akce

9. 10. 2017

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

000432617200026