以異常為基礎之即時通訊惡意網址偵測

Anomaly Based Malicious URL Detection in Instant Messaging

官大智(D. J. Guan) ； 陳嘉玫(Chia-Mei Chen) ； 林家賓(Jia-Bin Lin) ； 王則堯(Tse-Yao Wang)

《資訊管理學報》 19卷3期 (2012/07) Pp. 567-589

https://doi.org/10.6382/JIM.201207.0567

摘要

由於即時通訊（Instant Messaging, IM）的普遍性及立即性，現今已成為駭客散佈惡意軟體（malware）的平台。並且為了躲避防毒軟體的偵測，已較少使用傳送惡意檔案的方式，而是以傳送惡意網址（malicious URL）為目前普遍的擴散途徑。這些惡意網址可能會下載病毒檔案或是連到釣魚網站（phishing website）。一旦使用者被IM惡意程式攻陷，惡意網址就會透過受害者的連絡人清單繼續擴散出去，而且有時候還會搭配社交工程的手法，使得收訊者很難判斷此連結是否為惡意。而目前缺乏有效的解決方案，能夠即時地偵測IM惡意網址。本研究提出一個即時偵測IM惡意網址的方法。此方法基於網址的異常特徵及傳訊者的異常行為，定義了一組行為模式來描述可能的惡意行為，並且利用計分演算法來評估異常特徵的重要性，藉此預測網址是否為惡意。為了增加偵測速度，惡意行為模式可以有效地用來識別已知的惡意網址，另外計分演算法產生的分數模型，可以被用來偵測未知的惡意網址。實驗結果顯示，本研究提出的方法能夠達到低誤警率（false positive rate）和低誤判率（false negative rate）。

關鍵字

即時通訊 ； 惡意網址 ； 即時通訊蠕蟲

並列摘要

Instant messaging (IM) has been a platform of spreading malware for hackers due to its popularity and immediacy. To evade anti-virus detection, hacker might send malicious URL message, instead of malicious binary file. A malicious URL is a link pointing to a malware file or a phishing site, and it may then propagate through the victim's contact list. Moreover, hacker sometimes might use social engineering tricks making malicious URLs hard to be identified. The previous solutions are improper to detect IM malicious URL in real-time. Therefore, we propose a novel approach for detecting IM malicious URL in a timely manner based on the anomalies of URL messages and sender's behavior. Malicious behaviors are profiled as a set of behavior patterns and a scoring model is developed to evaluate the significance of each anomaly. To speed up the detection, the malicious behavior patterns can identify known malicious URLs efficiently, while the scoring model is used to detect unknown malicious URLs. Our experimental results show that the proposed approach achieves low false positive rate and low false negative rate.

並列關鍵字

Instant Messaging ； Malicious URL ； IM Worms

參考文獻

卿斯漢、王超、何建波、李大治(2006)。即時通訊蠕蟲研究與發展。軟件學報。17(10)，2118-2130。

Basnet, R.,Mukkamala, S.,Sung, A. H.(2008).Detection of phishing attacks: a machine learning approach.Soft Computing Applications in Industry.373-383.

Barabasi, A. L.,Bonabeau, E.(2003).Scientific American Magazine.

Fette, I.,Sadeh, N.,Tomasic, A.(2007).Learning to detect phishing emails.Proceedings of the 16th international conference on World Wide Web.(Proceedings of the 16th international conference on World Wide Web).

Group, A. P. W., 'Global phishing survey(2009): domain name use and trends in 1H2008.', Available: http://apwg.org/reports/APWG GlobalPhishingSurvery1H2008.pdf(accessed January 2010).