1. Automatic classification
of web-based malware
Alexander Sevtsov
Malware Analyst
Kaspersky Lab

2. Web-based malware
Chain of events
2
Compromised
web-site
Gate
(redirect)
Landing Page
of Exploit Kit

3. Machine learning
Learning
problems
Supervised
Learning
Classification Regression
Unsupervised
Learning
Clustering
3

4. Statement of the Problem
To develop an automatic classification
(detection) system for web-based malware
using supervised learning
4

5. System Diagram for the Automatic Classification
Collecting Files
Extracting Features
Data Analysis
Classifier selection
5

6. Collecting Files
Samples
Clean Malicious
6

7. Extracting Features
F1
F2
F3
F4
…
FN
7

8. Extracting Features
Feature Description
F1 Using external script <script src="http://
F2 The amount of script blocks
F3 Using constant obfuscation: ‘http:’ + ‘:/’ + ‘ex’ + ‘ample.c’ + ‘om’
F4 Using Meta Redirect <meta http-equiv="refresh" content="0; url=http://example.com/">
F5 Set "location.href" for the document
F6 Using hidden attributes: "display:none", "visibility:hidden", "position:absolute; left: -10000;" (Sweet Orange EK)
F7 Check the cookies associated with the current document (Fiesta EK)
8

9. Extracting Features
CLASS F1 F2 F3 F4 … FN
Clean False 0 351 5 0
Malware True 1 4300 25 1
Malware False 1 2542 4 0
Malware False 0 301 1 1
Clean True 1 1502 90 1
…
Clean True 1 556 2 0
9

10. Data Analysis
10
Dataset
Training Testing

11. Data Analysis
Dimensionality
Reduction
Principal
Component
Analysis
Random
Projections
11

12. Data Analysis
CLASS F1 F2 F3 F4 … FN
Clean False 0 351 5 0
Malware True 1 4300 25 1
Malware False 1 2542 4 0
Malware False 0 301 1 1
Clean True 1 1502 90 1
…
Clean True 1 556 2 0
12

13. Classifier selection
Output
13

14. Classifier selection
Analyze a confusion matrix
malicious clean
malicious 174 27
clean 44 41
14

15. Classifier selection
Machine
Learning
Algorithms
Naive Bayes
Classifier
Support Vector
Machines
Logistic
Regression
Nearest
Neighbors
Classification
Random Forest
…
15

16. Script Insertion
16

17. Using an external script
17

18. Constant Obfuscation
18

19. Using Meta-Redirect
19

20. Using Hidden Attributes
20

21. Checking document cookies
21

22. Finding Exploit Kits
Clean MX
Scumware
Malware
don't need
Coffee
Users
Threatglass
by Barracuda
22

23. Questions?
23