Exploiting Visual Appearance to Cluster and Detect Rogue

Exploiting Visual Appearance to Cluster and Detect Rogue Software SAC '13 Proceedings of the 28 th Annual ACM Symposium on Applied Computing, Pages 1776 -1783, ACM New York, NY, USA, 2013. Christian J. Dietrich (University of Applied Sciences Gelsenkirchen, Germany and University of Erlangen, Germany) Christian Rossow (University of Applied Sciences Gelsenkirchen, Germany and VU University Amsterdam, The Netherlands) Norbert Pohlmann (University of Applied Sciences Gelsenkirchen, Germany) 2014 / 10 / 23　M 2　haseshun 1

Christian J. Dietrich • Project director - Institute for Internet Security, University of Applied Sciences Gelsenkirchen • University of Mannheim Dr. (Ph. D), Malware Analysis 2009 – 2013 • Malware Analysis Botnet Detection Reverse Engineering Security Research Security Network Security Computer Security 2

1. INTRODUCTION • A malware • The user is tricked into – Spam bots spending money for a rogue software. – Banking trojans • All rogue software has in – DDo. S bots common to provide a user – etc. interface. – Rogue software • Fake A/V • Ransomware 3

1. INTRODUCTION • Fake A/V 4

1. INTRODUCTION • Ransomware 5

1. INTRODUCTION • A/V detection rates of rogue software・・・ 11% for better detection rates • A clustering of rogue software – A perceptual hash function – A hierarchical clustering A scalable method to cluster and classify rogue software based on its user interface 6

2. METHODOLOGY • An overview 7

2. METHODOLOGY • The user interfaces of Fake A/V – The rogue software name – The logo – The number of dangerous files – The position of the logo – The sizes of user interface elements vary constant 8

2. METHODOLOGY • The user interfaces of Fake A/V – The Winwebsec family 9

2. METHODOLOGY • The user interfaces of Fake A/V – The Fake. Rean family 10

2. METHODOLOGY • Clustering – Aim at separating the images of the Winwebsec family from those of the Fake. Rean family – The position of a logo recognize – The sizes of user interface elements – Colors – The exact program name ignore – The text inside user interface elements – Window title 11

2. METHODOLOGY 1. Dataset – More than 2, 000 malware families – 213, 671 malware samples – 213, 671 screenshots – Occasionally, a legitimate software • Adobe Flash Installer • etc. 12

2. METHODOLOGY 2. Malware User Interfaces – Execute the malware sample in a virtual machine • Windows XP 32 bit SP 3 – Have limited Internet access • Restricted outgoing traffic – No user interaction was performed – Store a screenshot 13

2. METHODOLOGY 3. Perceptual Hash Functions – Screenshot • 24 bit color depth, 800 × 600 pixel, 11 MByte – Perceptual hash functions • Aim at grasping semantic differences of a certain context – Cryptographic hash functions • Aim at resulting in two different hash values upon the slightest difference between two input 14 values

2. METHODOLOGY 3. Perceptual Hash Functions 1. An image is converted to grey scale 2. A smoothing 3. The image is resized to 32 × 32 pixels 4. The perceptual hash function based on the discrete cosine transform (DCT) An 8 -byte hash value A feature vector Fingerprint 15

2. METHODOLOGY 4. Intra-Fingerprint Coherence – 213, 671 images(17, 767 perceptual hash values) – Two images with the same hash value • Might not reflect the structural and perceptual similarity authors aim at？？？ – Test • 345 fingerprint values(2% of 17, 767) • At least 35 screenshot images per fingerprint • Inspected at least three random images manually 16

2. METHODOLOGY 4. Intra-Fingerprint Coherence – Test • The positions of user interface elements • The positions of logos • The positions of progress bars • The positions of text area • The positions of list or table elements In all fingerprints, the images provided the required similarity in structure. 17

2. METHODOLOGY 4. Intra-Fingerprint Coherence – Test • Classify → Labeling – Rogue software – An error message – A blank screen – etc. • 18 Fake A/V • 2 ransomware 18

2. METHODOLOGY 5. Distance Computation and Clustering – A malware • Spans multiple different fingerprint values – The position of the application window – Different views of rogue software interfaces 19

2. METHODOLOGY 5. Distance Computation and Clustering – Distance function between two perceptual hashes • The perceptual hashes : a fixed length of 8 bytes • The hamming distance returns the number of differing bits, with a maximum of 64 • The normalized hamming distance : distance / 64 = 0. 0 〜 1. 0 – Agglomerative hierarchical clustering • Average linkage(avoid the chaining phenomenon) 20

2. METHODOLOGY 5. Distance Computation and Clustering – Agglomerative hierarchical clustering • The chaining phenomenon 21

3. EVALUATION 1. Clustering evaluation – 187, 560 screenshots – 700 non-labeled fingerprints – 345 labeled fingerprints – Precision・Recall ・F-measure – Precision is more important than Recall To have all fingerprints of one campaign in only one single cluster ∧ To separate fingerprints of two campaigns 22

3. EVALUATION 1. Clustering evaluation – Answer Ak　Result. Ch　Number of data N　β = 1 / 2 – Precision Pkh – Recall Rkh – F-measure Fhk, F 23

3. EVALUATION 1. Clustering evaluation 93. 32 345 Fingerprint 0. 375 24

3. EVALUATION 1. Clustering evaluation – 51 clusters • 10 clusters did not have any labeled fingerprints – Fake A/V, Ransomware(5 clusters) – A crack program, Firefox, Windows Photo Viewer, Media Finder Installer, Dialog 25

3. EVALUATION 1. Clustering evaluation – Red • Non-rogue software – Blue • The malware(not Fake A/V, Ransomware) • Installers for various other software – Black • Fake A/V 26 • Ransomware

3. EVALUATION 2. Performance – The computation of the perceptual hash : C++ – The computation of the clustering : Python – Database : Postgre. SQL – The perceptual hash computation : 20. 13 min / 10, 000 images 120 ms / 1 image – The clustering of 17, 767 fingerprints : over 10 27 min

4. MONETIZATION AND LOCALIZATION 1. Ransomware Campaigns – p : paysafecard – u : ukash 28

4. MONETIZATION AND LOCALIZATION 2. Fake A/V Campaigns – M : months, Y : years, LL : lifelong – MC : Mastercard 29

5. LIMITSTIONS • Perceptual hash function – Depends on low-frequency coordinates – Noise which results in a change in high frequencies will not change the perceptual hash value • Fake A/V and the legitimate Antivirus programs – The user interface • different : detect exactly this difference • same: fail？？？ Fake A/V will always have to provide 30 some kind of payment user interface.

6. CONCLUSION • Authors propose a new approach to cluster and detect rogue software based on its inherent need to display a user interface • Using a perceptual hash function and a hierarchical clustering on a set of 187, 560 screenshot images, authors successfully identified 25 campaigns, spanning Fake A/V and Ransomware. • Using the results of our clustering approach, authors show that Fake A/V campaigns seem to favor credit card payment, Ransomware programs use prepay 31 methods.