Cache, Trigger, Impersonate: Enabling Context-Sensitive Honeyclient Analysis On-the-Wire
Teryl Taylor, Kevin Z. Snow, Nathan Otterness, Fabian Monrose · 2016
Today's sophisticated web exploit kits use polymorphic techniques to obfuscate each attack instance, making content-based signatures used by network intrusion detection systems far less effective than in years past.A dynamic analysis, or honeyclient analysis, of these exploits plays a key role in initially identifying new attacks in order to generate content signatures.While honeyclients can sweep the web for attacks, they provide no means of inspecting end-user traffic on-the-wire to identify attacks in real time.This leaves network operators dependent on third-party signatures that arrive too late, or not at all.In this paper, we introduce the design and implementation of a novel framework for adapting honeyclient-based systems to operate on-the-wire at scale.Specifically, we capture and store a configurable window of reassembled HTTP objects networkwide, use lightweight content rendering to establish the chain of requests leading up to a suspicious event, then serve the initial response content back to the honeyclient system on an isolated network.We demonstrate the power of our framework by analyzing a diverse collection of web-based exploit kits as they evolve over a one year period.Our case studies provide several interesting insights into the behavior of these exploit kits.Additionally, our empirical evaluations suggest that our approach offers significant operational value, and a single honeyclient server can readily support a large campus deployment.