Malware Mitigation and Remediation Strategies

In today’s Internet connected environment, there is no doubt that the web is the main vector of attacks for cybercriminals, and the huge amount of everyday new threats suggests this situation isn’t going to change anytime soon. Many of the most malicious attacks start as an apparently innocuous spam message with few words of text with bad spelling and a single URL. These messages often fool classical spam engines that probably simply look for keywords. All it takes is one distracted or curious click of the mouse and the site is visited: web attack is launched or the malicious payload is downloaded, probably providing remote access to the user’s computer, and maybe to the internal network. Criminals through Internet control networks of such compromised computers, called botnets, and use them to commit a multitude of frauds and thefts. Furthermore, botnets provide bandwidth which is used to launch distributed denial-of-service attacks (DDoS) and to send unsolicited email (spam), as well as IP address diversity to make IP address-based blocking strategy ineffective. Spam emails sent during those attacks are themselves vectors of attacks, used to deceive people into entering login credentials (phishing), installing malicious software (malware), or sharing bank account information (scams). And so the cycle repeats: email related threats create new botnet hordes, which are able to launch a flood of spam to drown our mailboxes. Recently botnets, through the adoption of particular techniques, become more resistant to discovery and counter-measures, and one of these new technique is named fast-flux. This dissertation presents FluXOR, the system we developed to detect and monitor fast-flux service networks. FluXOR monitoring and detection strategies entirely rely on the analysis of a set of features observable from the point of view of a victim of the scams perpetrated through the botnets. The