Detecting web exploit kits by tree-based structural similarity search

Patent metadata

Field	Value
Publication number	US-2016337388-A1
Application number	US-201514750290-A
Country	US
Kind code	A1
Filing date	Jun 25, 2015
Priority date	May 14, 2015
Publication date	Nov 17, 2016
Grant date	—

Abstract

A method of detecting exploit kits includes receiving, at an input port of a computer, indication of HTTP (Hypertext Transfer Protocol) traffic. The HTTP traffic is clustered into a web session tree according to a client IP (Internet Protocol. A client tree structure of the web session tree is generated. The client tree structure is compared with tree structures of exploit kit samples.

First claim

What is claimed is:

1 . A method comprising:
receiving, at an input port of a computer, indication of HTTP (Hypertext Transfer Protocol) traffic; clustering, using a processor on the computer, the HTTP traffic according to a client IP (Internet Protocol) into a web session tree; generating a client tree structure of the web session tree; and comparing the client tree structure with tree structures of exploit kit samples.

2 . The method according to claim 1 , further comprising, if at least one subtree of the client tree structure is determined to be similar to at least one subtree structure of at least one exploit kit sample within a predefined similarity value, classifying at least one subtree of the client tree structure as malicious.

3 . The method according to claim 2 , wherein a determination of similarity comprises calculating a similarity value between a subtree structure of the client tree structure and subtree structures of the exploit kit samples and the subtree structure of the client is determined as similar to any exploit kit sample if the similarity value is calculated to be higher than a predetermined value.

4 . The method according to claim 1 , wherein a plurality of exploit kit samples are stored in an index for the comparing with client tree structures, the method further comprising:
classifying the exploit kit samples into types of exploit kits; calculating a similarity value between exploit kit samples in each type; and using a lowest similarity value of exploit kit samples of a same type as a comparison threshold value for a node level similarity comparison between client tree structures and exploit kit samples of that type.

5 . The method according to claim 1 , further comprising using a honeyclient to gather one or more exploit kit samples to be used for the comparing with client tree structures, the honeyclient comprising a browser designed to detect changes in the browser or an operating system upon which the browser is operating.

6 . The method according to claim 1 , wherein tree structures are converted into a canonical format for the comparing, the canonical format comprising a listing of a string of node identifiers that encodes a tree structure that lists each node of a tree structure in a preorder traversal of the tree structure.

7 . The method according to claim 1 , wherein tree structures are compared initially using a node level similarity search followed by a structural similarity search if the node level similarity search results in a similarity between two tree structures above a predetermined similarity amount.

8 . The method according to claim 7 , wherein the node level similarity search comprises a comparison of node features of two tree structures using a similarity metric.

9 . The method according to claim 8 , wherein a threshold for similarity is defined based on comparison values of nodes in different exploit kit samples of a same type of exploit kits.

10 . The method according to claim 8 , wherein the similarity metric comprises one of a Jaccardin Index and a weighted Jaccardian Index.

11 . The method according to claim 7 , wherein the structural similarity search is executed using a tree edit distance metric based upon determining a number of deletions, insertions, or label renamings to transform a first tree into a second tree.

12 . The method according to claim 1 , wherein the clustering of the client IP HTTP traffic occurs in a predefined time window.

13 . The method according to claim 1 , wherein the client tree structure is further compared with instance samples of one or more clickjacking schemes, each clickjacking scheme comprising coding that hides coding on a malicious website beneath apparently legitimate buttons, thereby tricking a user into clicking onto something different than perceived.

14 . The method according to claim 1 , as embodied in a set of computer-readable instructions tangibly embodied on a non-transitive storage device.

15 . The method according to claim 14 , wherein the non-transitive storage device comprises one of:
a memory device in a computer, as storing programs to be selectively executed by a processor on the computer; a memory device on the computer, as storing a program currently being executed by the processor; a memory device on a computer selectively connectable to a network, the computer configured to download the set of instructions onto a memory device on another computer in the network; and a standalone memory device that can be used to transfer the set of instructions into a memory device on a computer.

16 . A method of deploying computer resources, said method comprising provisioning a memory device in a server accessible via a network with a set of computer-readable instructions for a computer to execute a method of detecting exploit kits, wherein the method comprises:
receiving, at an input port of the computer, indication of HTTP (Hypertext Transfer Protocol) traffic; clustering, using the processor on the computer, the HTTP traffic according to a client IP (Internet Protocol) into a web session tree; generating a client tree structure of the web session tree; and comparing the client tree structure with tree structures of exploit kit samples.

17 . The method of claim 16 , wherein the server one of:
executes the method of detecting beaconing behavior based on network data received from a local area network of computers for which the server serves as a network portal; receives a request from a computer via the network to execute the method of detecting beaconing behavior, receives data from the requesting computer to be processed by the method, and returns to the requesting computer a result of executing the method on the received data; and receives a request from a computer via the network to execute the method and transmits the set of computer-readable instructions to the requesting computer to itself execute the method of detecting beaconing behavior.

18 . The method of claim 16 , wherein the server provides a service of executing the method of detecting beaconing behavior as a cloud service.

Assignees

• IBM

Inventors

• Hu Xin
• Jang Jiyong
• Monrose Fabian
• Stoecklin Marc Philippe
• Taylor Teryl
• Wang Ting

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F16/285

  Clustering or classification · CPC title

• H04L63/168

  above the transport layer · CPC title