HoneyIM: Fast Detection and Suppression of Instant Messaging Malware in Enterprise-like Networks

DMCA

HoneyIM: Fast Detection and Suppression of Instant Messaging Malware in Enterprise-like Networks

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Mengjun Xie , Zhenyu Wu , Haining Wang

Citations:

10 - 3 self

BibTeX

@MISC{Xie_honeyim:fast,
    author = {Mengjun Xie and Zhenyu Wu and Haining Wang},
    title = {HoneyIM: Fast Detection and Suppression of Instant Messaging Malware in Enterprise-like Networks},
    year = {}
}

OpenURL

Abstract

Instant messaging (IM) has been one of most frequently used malware attack vectors due to its popularity. Distinct from other malware, it is straightforward for IM malware to find and hit the next victim by exploiting the current victim’s contact list and playing social engineering tricks. Thus, the spread of IM malware is much harder to detect and suppress through conventional approaches. The previous solutions are ineffective to defend against IM malware in an enterprise-like network environment, mainly because of high false positive rate and the requirement of the IM server being inside the protected network. In this paper, we propose a novel IM malware detection and suppression mechanism, HoneyIM, which guarantees almost zero false positive on detecting and blocking IM malware in an enterprise-like network. The detection of HoneyIM is based on the concept of honeypot. HoneyIM uses decoy accounts to trap IM malware by leveraging malware spreading characteristics. Fed with accurate detection results, the suppression of HoneyIM can conduct a network-wide blocking. In addition, HoneyIM delivers attack information to network administrators in real-time so that system quarantine and recovery can be quickly performed. The core design of HoneyIM is generic, and can be applied to the scenarios that either enterprise IM services or public IM services are used in the protected network. Based on open-source IM client Pidgin and client honeypot Capture, we build a prototype of HoneyIM and validate its efficacy through both simulations and real experiments. Our results show that HoneyIM provides effective protection against IM malware in enterprise-like networks. 1.

Keyphrases

im malware enterprise-like network instant messaging malware fast detection protected network client honeypot capture novel im malware detection conventional approach enterprise-like network environment im server attack information effective protection current victim contact list suppression mechanism high false positive rate network-wide blocking social engineering trick system quarantine public im service decoy account real experiment accurate detection result instant messaging core design network administrator next victim previous solution open-source im client pidgin malware attack vector enterprise im service

DMCA