Identifying Evasive Code in Malicious Websites by Analyzing Redirection Differences

Abstract

Security researchers/vendors detect malicious websites based on several website features extracted by honeyclient analysis. However, web-based attacks continue to be more sophisticated along with the development of countermeasure techniques. Attackers detect the honeyclient and evade analysis using sophisticated JavaScript code. The evasive code indirectly identifies vulnerable clients by abusing the differences among JavaScript implementations. Attackers deliver malware only to targeted clients on the basis of the evasion results while avoiding honeyclient analysis. Therefore, we are faced with a problem in that honeyclients cannot analyze malicious websites. Nevertheless, we can observe the evasion nature, i.e., the results in accessing malicious websites by using targeted clients are different from those by using honeyclients. In this paper, we propose a method of extracting evasive code by leveraging the above differences to investigate current evasion techniques. Our method analyzes HTTP transactions of the same website obtained using two types of clients, a real browser as a targeted client and a browser emulator as a honeyclient. As a result of evaluating our method with 8,467 JavaScript samples executed in 20,272 malicious websites, we discovered previously unknown evasion techniques that abuse the differences among JavaScript implementations. These findings will contribute to improving the analysis capabilities of conventional honeyclients.

REdiREKT: Extracting Malicious Redirections from Exploit Kit Traffic

“…We conclude that only considering the features of the domain which delivers the exploit leads to the loss of important data. Research focusing on the malicious redirection chains [17], [24]- [30] have slightly different goals or methods, as described in section III.…”

“…Takata et al [17] crawled 20,272 malicious websites over 4 years, extracting 8467 JS samples. They visited each website with a browser emulator (honeyclient), and, a real browser (targeted client) with different JS implementations.…”

LSTM RNN: detecting exploit kits using redirection chain sequences

“…The small dataset used in Nagai et al (2019) misses many high profile EKs (Angler, Nuclear, Neutrino, Rig, Fiesta), and, modelling redirects based on time alone is problematic. Redirection chains are mapped in Takata et al (2018), but, content-based redirects are not considered. Shibahara et al (2019) models redirections irrespective of occurrence, e.g.…”

MMWD: An efficient mobile malicious webpage detection framework based on deep learning and edge cloud

“…Altay et al 17 proposed a context‐sensitive and keyword density‐based method by using three machine learning techniques. Compared with the dynamic method of virtual machine real‐time detection 24,25 and honeypot system, 26 the static method based on machine learning can effectively detect unknown malicious web pages, and can avoid costly in‐depth analysis for all webpages.…”