1. Towards Extending the Antivirus Capability to Scan Network Traffic Mohammed I. Al-Saleh Jordan University of Science and Technology

2. Outline Problem and Background Threat Model System Architecture Conclusions and Future work

4. Antivirus Virus Signatures

5. Antivirus (cont.) On-access Scanner – Scan on file system operations – Open, read, write, close, etc. On-demand – Scan on user request

6. Problem in Scanning Network Traffic Al-Saleh et al., “Investigating the detection capabilities of antiviruses under concurrent attacks”. IET IFS Journal, 2014. AntivirusDetect? Kaspersky Anti-Virus 6.0No Symantec Endpoint Protection 11.0No Sophos Endpoint Security, and Control 10.0No Panda Internet Security 2014No Avg Internet Security 2014No BitDefender Internet Security 2014No Avast Internet Security 2014No TotalDefense Internet SecurityNo

7. Problem (cont.) Most malware infect victims through networks – Worm – Adware – Trojan Horse – Spam – Botnet – Etc.

8. Why? Is it hard to scan network traffic? – How hard is it? Drop security for performance? – How much performance degradation when scanning network traffic? Still speculation! – Exact reason is NOT known

9. Solution Very simple – It is a MUST to scan network traffic How? – Hmmmm, needs more thinking…

10. Threat Model

11. Basic Idea Simply, we need a way to tell the AV to scan network data. – Discrete packets (IP level) ineffective scanner; – Malware spans different packets – Out of order – Higher level (TCP) Builds state machine Maintains order Separates connections Separates inbound from outbound traffic

12. Packet Capturing (pcap) Kernel modules – passively capture network traffic and pass them to user space processes through a well-defined Application Programming Interface (API) Examples: Tcpdump and Wireshark Use such libraries to build a state machine for TCP connections

13. ClamAV The most popular open-source AV – www.clamav.net www.clamav.net Allows agents to make use of it programmatically – Link to the ClamAV shared library – ClamAV daemon along with the database of virus signatures are loaded once and shared with the user agents.

14. System Architecture

15. Conclusion and Future Work Antivirus software MUST scan network traffic The proposed system will be implemented Performance impact should be studied

16. Acknowledgements Jordan University of Science and Technology for the financial support

17. Thanks