Network Security White Papers
SpyCon: Emulating User Activities to Detect Evasive Spyware
Overview The success of any spyware is determined by its ability to evade detection. Although traditional detection methodologies employing signature and anomaly based systems have had reasonable success, new class of spyware programs emerge which blend in with user activities to avoid detection. One of the latest anti-spyware technologies consists of a local agent that generates honeytokens of known parameters (e.g., network access requests) and tricks spyware into assuming it to be legitimate activity. This paper describes the deficiencies of static honeytoken generation and presents an attack that circumvents such detection techniques. The author synthesizes the attack by means of data mining algorithms like associative rule mining.
| Publisher | University at Buffalo | File Format | |
|---|---|---|---|
| Date Published | February 2007 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful?
White Paper RSS
Download
