Towards Extending the Antivirus Capability to Scan Network Traffic Mohammed I. Al-Saleh Jordan University of Science and Technology

Outline Problem and Background Threat Model System Architecture Conclusions and Future work

Antivirus Virus Signatures

Antivirus (cont.) On-access Scanner – Scan on file system operations – Open, read, write, close, etc. On-demand – Scan on user request

Problem in Scanning Network Traffic Al-Saleh et al., “Investigating the detection capabilities of antiviruses under concurrent attacks”. IET IFS Journal, AntivirusDetect? Kaspersky Anti-Virus 6.0No Symantec Endpoint Protection 11.0No Sophos Endpoint Security, and Control 10.0No Panda Internet Security 2014No Avg Internet Security 2014No BitDefender Internet Security 2014No Avast Internet Security 2014No TotalDefense Internet SecurityNo

Problem (cont.) Most malware infect victims through networks – Worm – Adware – Trojan Horse – Spam – Botnet – Etc.

Why? Is it hard to scan network traffic? – How hard is it? Drop security for performance? – How much performance degradation when scanning network traffic? Still speculation! – Exact reason is NOT known

Solution Very simple – It is a MUST to scan network traffic How? – Hmmmm, needs more thinking…

Threat Model

Basic Idea Simply, we need a way to tell the AV to scan network data. – Discrete packets (IP level) ineffective scanner; – Malware spans different packets – Out of order – Higher level (TCP) Builds state machine Maintains order Separates connections Separates inbound from outbound traffic

Packet Capturing (pcap) Kernel modules – passively capture network traffic and pass them to user space processes through a well-defined Application Programming Interface (API) Examples: Tcpdump and Wireshark Use such libraries to build a state machine for TCP connections

ClamAV The most popular open-source AV – Allows agents to make use of it programmatically – Link to the ClamAV shared library – ClamAV daemon along with the database of virus signatures are loaded once and shared with the user agents.

System Architecture

Conclusion and Future Work Antivirus software MUST scan network traffic The proposed system will be implemented Performance impact should be studied

Acknowledgements Jordan University of Science and Technology for the financial support

Thanks