2016 11th Asia Joint Conference on Information Security (AsiaJCIS)最新文献

筛选

英文中文

Observing Hidden Service Directory Spying with a Private Hidden Service Honeynet 观察隐藏服务目录间谍与私有隐藏服务蜜网

2016 11th Asia Joint Conference on Information Security (AsiaJCIS) Pub Date : 2016-08-01 DOI: 10.1109/AsiaJCIS.2016.31

Juha Nurmi, Joona Kannisto, Markku Vajaranta

引用次数: 3

Evaluation of a Brute Forcing Tool that Extracts the RAT from a Malicious Document File 一种从恶意文档文件中提取RAT的暴力强制工具的评估

2016 11th Asia Joint Conference on Information Security (AsiaJCIS) Pub Date : 2016-08-01 DOI: 10.1109/AsiaJCIS.2016.17

M. Mimura, Yuhei Otsubo, Hidehiko Tanaka

{"title":"Evaluation of a Brute Forcing Tool that Extracts the RAT from a Malicious Document File","authors":"M. Mimura, Yuhei Otsubo, Hidehiko Tanaka","doi":"10.1109/AsiaJCIS.2016.17","DOIUrl":"https://doi.org/10.1109/AsiaJCIS.2016.17","url":null,"abstract":"APT(Advanced Persistent Threat) attacks that cause unauthorized transfer of sensitive information from the targeted organization are serious threats. The attackers in APT attacks use RAT(Remote Access Trojan or Remote Administration Tool)s to take the control of the victim's computer. The attackers in APT attacks occasionally use malicious document files to camouflage themselves. If a RAT is embedded into a malicious document file, it is more difficult to detect and analyze the function. Analyzing malicious document files attached to spear phishing e-mails requires extracting the RAT. However, if we do not know the condition where the exploit code runs normally, it is difficult to extract the RAT by dynamic analysis. Therefore, we developed a brute forcing tool which decodes obfuscation and extracts the RAT from a malicious document file. This tool was developed based on the malicious document files which were used between 2009 and 2012 in APT attacks, and indicated how to embed a RAT in a malicious document file. However, whether our method can extract or detect recent RATs in APT attacks or not is uncertain. In this paper, we investigate recent malicious document files which were used between 2013 and 2015 in APT attacks, and reveal the recent trend of the encoding methods with this tool. Moreover, we compare the success rates with the other detection methods such as antivirus programs with the latest virus definitions. Even if a malicious document file which contains executable files does not perform malicious activities in dynamic analysis, this tool extracts the executable files automatically without executing the malicious document file. In addition, this tool hardly give false positives. We can use this tool to detect unknown malicious document files in dynamic analysis or at mail gateways.","PeriodicalId":213242,"journal":{"name":"2016 11th Asia Joint Conference on Information Security (AsiaJCIS)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123598390","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

Efficient Privacy-Preserving Logistic Regression with Iteratively Re-weighted Least Squares 基于迭代重加权最小二乘的高效隐私保护逻辑回归

2016 11th Asia Joint Conference on Information Security (AsiaJCIS) Pub Date : 2016-08-01 DOI: 10.1109/AsiaJCIS.2016.21

Hiroaki Kikuchi, H. Yasunaga, H. Matsui, Chun-I Fan

引用次数: 3

首页上一页