Detecting web exploit kits by tree-based structural similarity search

摘要

A method of detecting exploit kits includes receiving, at an input port of a computer, indication of HTTP (Hypertext Transfer Protocol) traffic. The HTTP traffic is clustered into a web session tree according to a client IP (Internet Protocol. A client tree structure of the web session tree is generated. The client tree structure is compared with tree structures of exploit kit samples.

主权项

1. A method comprising:
receiving, at an input port of the computer, indication of HTTP (Hypertext Transfer Protocol) traffic; clustering, using the processor on the computer, the HTTP traffic according to a client IP (Internet Protocol) into a web session tree; generating a client tree structure of the web session tree; and comparing the client tree structure with each tree structure of a plurality of exploit kit samples; wherein the plurality of exploit kit samples are stored in an index for the comparing with the client tree structure, the method comprising:
classifying each of the plurality of exploit kit samples into a type of exploit kit;for each type, calculating a plurality of similarity values between each of the exploit kit samples classified in the type;and using a lowest similarity value of the plurality of similarity values, as a comparison threshold value for a node level similarity comparison between the client tree structure and the plurality of classified exploit kit samples of the corresponding type.