My paper of choice was "Detection of Unknown Malicious Codes Based on Group File Characteristics" by InSeog Seo, InJung Kim, JangHong Yoon, JaeCheol Ryou. The developers analyzed the possibility, of a intrusion detection / prevention system, that would rely on a network, that share most of the node's content.
They established, that current malicious-detection solutions have limitations, that needs to be addressed. The major point is, that the attacker has the advantage. Since most systems work on a signature or pattern based, new and novel attacks are hard to detect, and even more challenging to prevent the intrusion. They cover the basic theories, how malwares operate and basic defense techniques in place.
Their concept of preventing malicious code intrusion, to monitor file changes and centralize a change history, based on the idea, that OS level patches and upgrades will result in identical changes. The proposed mechanism, how to detect anomalies, does not appeal to me, and seems ineffective. They proposed to mark extraordinary files as ordinary, if it passes the antivirus check, and the expansion of such anomaly within the network is within certain parameters. These criteria can be easily met by a moderately advanced malware.
They also planning to burden the end-hosts with a lot of hashing functions, which are not informative and infeasible in a real-world environment. They provided categorization of threats, yet I do not see, how can a single file, that might be only needed on one work-station can raise red-flag.
This research solely focus on DDoS attack, in a homogenous, constant environment: which assumptions and situations are unreal, and unlikely. Also since they heavily focused on Windows systems, there is no mentioning of other systems, where most centrally located security outposts are running some other operating systems.
This paper did not convinced me, that this approach could be successful or feasible.
Thanks for reading
--
Balazs Makany
No comments:
Post a Comment