Know your EK: A content and workflow analysis approach for exploit kits

Date

2019-02-01

Author

Suren, Emre
Angın, Pelin

Metadata

Show full item record

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Item Usage Stats

5
views

0
downloads

The prevalence and non-stop evolving technical sophistication of Exploit Kits (EKs) is one of the most challenging shifts in the modern cybercrime landscape. Over the last few years, malware infection via drive-by-download attacks have been orchestrated with EK infrastructures. An EK serves various types of malicious content via several threat vectors for a variety of criminal attempts, which are mostly monetary-centric. Malicious emails, malicious advertisements, and compromised websites redirect victim browsers to web-based EK families that are assembled to exploit client-side vulnerabilities and finally deliver evil payloads. Examples include mining crypto-currency to generate revenue, encrypting valuable files to demand ransom, stealing sensitive information for fraud, and turning the victim machine to a zombie to make it an instrument for further attacks. In this paper we provide an in-depth discussion of the EK philosophy and internals. We provide content analysis of the EK families from a publicly available dataset of over 2250 URLs using abstract syntax trees and propose strategies for protection from the devastating effects of this increasingly popular threat.

Subject Keywords

Exploit kit, Web malware, Drive-by-download, Cybercrime, Content analysis

URI

https://hdl.handle.net/11511/48873

Collections

Department of Computer Engineering, Article