BrowserGuard: A Behavior-Based Solution to Drive-by-Download Attacks

NCU Institutional Repository > 資訊電機學院 > 資訊工程學系 > 期刊論文 > Item 987654321/51619

請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/51619

題名:	BrowserGuard: A Behavior-Based Solution to Drive-by-Download Attacks
作者:	Hsu,FH;Tso,CK;Yeh,YC;Wang,WJ;Chen,LH
貢獻者:	資訊工程學系
日期:	2011
上傳時間:	2012-03-27 18:57:37 (UTC+8)
出版者:	國立中央大學
摘要:	Along with an increasing user population of various web applications, browser-based drive-by-download attacks soon become one of the most common security threats to the cyber community. A user using a vulnerable browser or browser plugins may become a victim of a drive-by-download attack right after visiting a vicious web site. The end result of such attacks is that an attacker can download and execute any code on the victim's host. This paper proposes a runtime, behavior-based solution, BrowserGuard, to protect a browser against drive-by-download attacks. BrowserGuard records the download scenario of every file that is loaded into a host through a browser. Then based on the download scenario, BrowserGuard blocks the execution of any file that is loaded into a host without the consent of a browser user. Due to its behavior-based detection nature, BrowserGuard does not need to analyze the source file of any web page or the run-time states of any script code, such as Javascript. BrowserGuard also does not need to maintain any exploit code samples and does not need to query the reputation value of any web site. We utilize the standard BHO mechanism of Windows to implement BrowserGuard on IE 7.0. Experimental results show that BrowserGuard has low performance overhead (less than 2.5%) and no false positives and false negatives for the web pages used in our experiments.
關聯:	IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS
顯示於類別:	[資訊工程學系] 期刊論文

文件中的檔案:

檔案	描述	大小	格式	瀏覽次數
index.html		0Kb	HTML	505	檢視/開啟

在NCUIR中所有的資料項目都受到原著作權保護.

社群 sharing

資料載入中.....