1. Spyware Detection Jeff Rosenberg Advisor: Professor Hemmendinger
Computer Science Senior Project
Winter 2006

2. Why bother?
Most spyware removal tools use a list of known spyware programs
List must be constantly updated
Won’t catch anything that’s not listed
At the mercy of those who create it
Rather than use a reference list, detect spyware based on patterns it shows
Avoids the need to update

3. The Program C++ program that uses MFC
Easy to make a dialog-based interface
Searches a computer, testing all files and directories it encounters
Displays a list of detected files and directories, along with their probabilities of being spyware
Based on which tests they passed

4. Searching Dir2 Dir4 Dir3 Bad Files List root Dir1 Dir3 File10 Dir2

5. Testing 123 Patterns – size, name, type
Tests – combinations of patterns that spyware often exhibits
SizePattern 400, 800
NamePattern “spy”
TypePattern “exe”
SpywareExe
- looks for executable files with “spy” in the name
SmallExe
- looks for executable files between 400 and 800 bytes
File
ThisIsSpyWare.exe
2KB
& =
& =

6. Time is on my side
Spyware often appears in groups, with all files created at the exact same time
Can also use these bad dates to find spyware in other locations
Algorithm to find date clusters in a given directory
Sort a list of files by date
Starting with the first file in the list, look through all of the files that follow as long as their dates are within a certain range of each other
Continue until a date is found outside of this range. The probability of being spyware for files in this cluster depends on how many files are in it.

7. Program Interface

8. Conclusions/Future Work
Can be hard to distinguish between good and bad files
Still did a good job of finding all the spyware on the test machine
Tests were developed from infections in October, but were still able to find spyware from new infections in February
Learning – adjusting tests on the fly and create new ones
Optimization
Many of the algorithms used can be sped up significantly
Still does okay, took 3 minutes and 35 seconds to scan 131,301 files (37GB)

9. Questions?