Anteater: Malware Injection Detection with Program Network Traffic Behavior

Abstract

Recent stealth attacks conceal malicious behavior behind seemingly normal connections to popular online services provided by seemingly harmless applications. These attacks are undetectable using traditional network monitoring and signature-based detection techniques. Because attackers frequently use well-known cloud vendors to conceal C&C servers, anomalous traffic appears to be normal. In this paper, we propose an application-level monitoring system named “Anteater”. Our “Anteater” generates a fine-grained profile of each benign software's network traffic behavior, describing the “expected” network traffic behavior. By analyzing the program's network traffic configuration, our “Anteater” can quickly determine the IP address of the program's abnormal access and intercept it in real-time. “Anteater” was implemented in a real-world enterprise dataset containing over 400 million real-world network traffic sessions. The evaluation results indicate that “Anteater” has a high detection rate for malware injection, with a true positive rate of 94.5% and a false positive rate of less than 0.1%.