TY - GEN
T1 - NetSpy
T2 - 22nd Annual Computer Security Applications Conference, ACSAC 2006
AU - Wang, Hao
AU - Jha, Somesh
AU - Ganapathy, Vinod
PY - 2006
Y1 - 2006
N2 - We present NetSpy, a tool to automatically generate network-level signatures for spyware. NetSpy determines whether an untrusted program is spyware by correlating user input with network traffic generated by the untrusted program. If classified as spyware, NetSpy also generates a signature characterizing the malicious substrate of the spyware 's network behavior. Such a signature can be used by network intrusion detection systems to detect spyware installations in large networks. In our experiments, NetSpy precisely identified each of the 1 spyware programs that we considered and generated network-level signatures for them. Of the 9 supposedlybenign programs that we considered, NetSpy correctly characterized 6 of them as benign. The remaining 3 programs showed network behavior that was highly suggestive of spying activity.
AB - We present NetSpy, a tool to automatically generate network-level signatures for spyware. NetSpy determines whether an untrusted program is spyware by correlating user input with network traffic generated by the untrusted program. If classified as spyware, NetSpy also generates a signature characterizing the malicious substrate of the spyware 's network behavior. Such a signature can be used by network intrusion detection systems to detect spyware installations in large networks. In our experiments, NetSpy precisely identified each of the 1 spyware programs that we considered and generated network-level signatures for them. Of the 9 supposedlybenign programs that we considered, NetSpy correctly characterized 6 of them as benign. The remaining 3 programs showed network behavior that was highly suggestive of spying activity.
UR - http://www.scopus.com/inward/record.url?scp=39049147640&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=39049147640&partnerID=8YFLogxK
U2 - https://doi.org/10.1109/ACSAC.2006.34
DO - https://doi.org/10.1109/ACSAC.2006.34
M3 - Conference contribution
SN - 0769527167
SN - 9780769527161
T3 - Proceedings - Annual Computer Security Applications Conference, ACSAC
SP - 99
EP - 108
BT - Proceedings - Annual Computer Security Applications Conference, ACSAC
Y2 - 11 December 2006 through 15 December 2006
ER -