System and method for detection of malicious hypertext transfer protocol chains
A system configured to detect malware is described. The system configured to detect malware including a data collector configured to detect at least a first hypertext transfer object in a chain of a plurality of hypertext transfer objects. The data collector further configured to analyze at least the first hypertext transfer object for one or more events. And, the data collector configured to generate a list of events based on the analysis of at least the first hypertext transfer object.
1. A device, comprising:
a memory; and
one or more processors to:
detect a plurality of hypertext transfer objects;
determine a score based on at least one of a file format or a header within the plurality of hypertext transfer objects;
determine, based on the score satisfying a threshold, that a sequence of the plurality of hypertext transfer objects is suspicious; and
instantiate, based on the sequence of the plurality of hypertext transfer objects being suspicious, a browser cooking environment.
2. The device of claim 1 , where the sequence of the plurality of hypertext transfer objects is determined based on a combination of file formats and headers of the plurality of hypertext transfer objects.
3. The device of claim 1 , where the one or more processors, when determining that the sequence of the plurality of hypertext transfer objects is suspicious, are to:
determine that a particular combination of file formats and headers, of the plurality of hypertext transfer objects, is suspicious.
4. The device of claim 1 , where the one or more processors, when instantiating the browser cooking environment, are to:
instantiate the browser cooking environment using a virtualization environment that is configured with a browser.
5. The device of claim 4 , where the virtualization environment is instrumented to collect one or more of an execution log or a call trace during operation of the browser.
6. The device of claim 4 , where the sequence of the plurality of hypertext transfer objects is replayed to the browser.
7. The device of claim 1 , where the one or more processors are further to:
replay the sequence of the plurality of hypertext transfer objects in the browser cooking environment.
8. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
detect a plurality of hypertext transfer objects;
determine a score based on at least one of a file format or a header within the plurality of hypertext transfer objects;
determine, based on the score satisfying a threshold, that a sequence of the plurality of hypertext transfer objects is suspicious; and
instantiate, based on the sequence of the plurality of hypertext transfer objects being suspicious, a browser cooking environment.
9. The non-transitory computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
replay the sequence of the plurality of hypertext transfer objects in the browser cooking environment.
10. The non-transitory computer-readable medium of claim 9 , where the one or more instructions, that cause the one or more processors to replay the sequence of the plurality of hypertext transfer objects in the browser cooking environment, cause the one or more processors to:
replay the sequence of the plurality of hypertext transfer objects in the browser cooking environment by redirecting requests, from a browser cooker, to a domain name system server and a web server.
11. The non-transitory computer-readable medium of claim 9 , where the one or more instructions, that cause the one or more processors to replay the sequence of the plurality of hypertext transfer objects in the browser cooking environment, cause the one or more processors to:
replay the sequence of the plurality of hypertext transfer objects in the browser cooking environment by setting a web server as a proxy server in a browser cooker.
12. The non-transitory computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
generate a data model based on a list of events for the sequence of the plurality of hypertext transfer objects,
the data model being used to recognize the sequence of the plurality of hypertext transfer objects.
13. The non-transitory computer-readable medium of claim 12 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
utilize machine-learning, based on the data model, to classify another sequence of hypertext transfer objects as malicious.
14. The non-transitory computer-readable medium of claim 12 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
compare another list of events and the data model; and
determine malware based on the other list of events matching the data model.
15. A method, comprising:
detecting, by a device, a sequence of a plurality of hypertext transfer objects;
determining, by the device, a score based on at least one of a file format or a header within the plurality of hypertext transfer objects;
determining, by the device and based on the score satisfying a threshold, that the sequence is suspicious; and
instantiating, by the device and based on the sequence being suspicious, a browser cooking environment.
16. The method of claim 15 , further comprising:
performing a frequency analysis of a body of one of the plurality of hypertext transfer objects; and
where determining the score comprises:
determining the score based on performing the frequency analysis.
17. The method of claim 16 , further comprising:
generating, based on performing the frequency analysis, a list of one or more events; and
where determining the score comprises:
determining the score based on generating the list of one or more events.
18. The method of claim 15 , further comprising:
determining whether the plurality of hypertext transfer objects comprises one or more calls to at least one of a web counter or a web analytic; and
where determining the score comprises:
determining the score based on determining whether the plurality of hypertext transfer objects comprises the one or more calls.
19. The method of claim 18 , further comprising:
generating a list of one or more events; and
storing a reference to the web counter or the web analytic based on determining that the plurality of hypertext transfer objects comprises the one or more calls.
20. The method of claim 15 , further comprising:
determining one or more vulnerabilities of an application used for communication based on the plurality of hypertext transfer objects; and
where determining the score comprises:
determining the score based on determining the one or more vulnerabilities.