NetSpy: Automatic Generation of Spyware Signatures for NIDS

Hao Wang, Somesh Jha, Vinod Ganapathy.

Proceedings of the 22nd Annual Computer Security Applications Conference (ACSAC 2006); pages 99--108; Miami Beach, Florida; December 11-15, 2006.

We present NetSpy, a tool to automatically generate network-level signatures for spyware. NetSpy determines whether an untrusted program is spyware by correlating user input with network traffic generated by the untrusted program. If classified as spyware, NetSpy also generates a signature characterizing the malicious substrate of the spyware's network behavior. Such a signature can be used by network intrusion detection systems to detect spyware installations in large networks.

In our experiments, NetSpy precisely identified each of the 7 spyware programs that we considered and generated network-level signatures for them. Of the 9 supposedly-benign programs that we considered, NetSpy correctly characterized 6 of them as benign. The remaining 3 programs showed network behavior that was highly suggestive of spying activity.

Paper: [ PDF ] (© IEEE)
Slides: [ Powerpoint ]
DOI: [ 10.1109/ACSAC.2006.34 ]

Papers page