1. Charles Curtsinger UMass at Amherst Benjamin Livshits and Benjamin Zorm Microsoft Research Christian Seifert Microsoft 20 th USENIX Security Symposium (August, 2011)

2. Charles Curtsinger UMass at Amherst Benjamin Livshits and Benjamin Zorm Microsoft Research Christian Seifert Microsoft Microsoft Research Technical Report (November, 2010)

3. Outline  Introduction  Observation on Offline Nozzle  Design  Experiment  Evaluation 2011/5/243A Seminar at Advanced Defense Lab

4. Introduction  In the last several years, we have seen mass-scale exploitation of memory- based vulnerabilities migrate towards heap spraying attacks.  But many solutions are not lightweight enough to be integrated into a commercial browser. 2011/5/24A Seminar at Advanced Defense Lab4

5. About Nozzle  The overhead of this runtime technique may be 10% or higher.  This paper is based on our experience using NOZZLE for offline.  Offline scanning is also not as effective against transient malware that appears and disappears frequently. 2011/5/24A Seminar at Advanced Defense Lab5

6. About Zozzle  ZOZZLE is integrated with the browser’s JavaScript engine to collect and process JavaScript code that is created at runtime.  Our focus in this paper is on creating a very low false positive, low overhead scanner. 2011/5/24A Seminar at Advanced Defense Lab6

7. Observation on Offline Nozzle  Once we determine that JavaScript is malicious, we invested a considerable effort in examining the code by hand and categorizing it in various ways.  we investigated 169 malware samples. 2011/5/24A Seminar at Advanced Defense Lab7

8. Distribution of Different Exploit Samples 2011/5/24A Seminar at Advanced Defense Lab8

9. Transience of Detected Malicious URLs 2011/5/24A Seminar at Advanced Defense Lab9

10. Javascript eval Unfolding 2011/5/24A Seminar at Advanced Defense Lab10

11. Distribution of Context Counts 2011/5/24A Seminar at Advanced Defense Lab11

12. Design 2011/5/24A Seminar at Advanced Defense Lab12

13. Training Data Extraction and Labeling  We start by augmenting the JavaScript engine in a browser with a “deobfuscator” that extracts and collects individual fragments of JavaScript. Detours [link]link jscript.dll [link]link Compile function ( COlescript::Compile() ) 2011/5/24A Seminar at Advanced Defense Lab13

14. Feature Extraction  We create features based on the hierarchical structure of the JavaScript abstract syntax tree(AST). 2011/5/24A Seminar at Advanced Defense Lab14

15. Feature Selection  χ 2 test  2011/5/24A Seminar at Advanced Defense Lab15 With featureWithout feature maliciousAC benignBD

16. Classifier Training  Naϊve Bayesian classifier   Assume to be conditionally independent  2011/5/24A Seminar at Advanced Defense Lab16

17. Naϊve Bayesian classifier   Complexity: linear time 2011/5/24A Seminar at Advanced Defense Lab17

18. Fast Pattern Matching 2011/5/24A Seminar at Advanced Defense Lab18

19. Fast Pattern Matching (cont.) 2011/5/24A Seminar at Advanced Defense Lab19

20. Experiment  Malicious Samples 919 deobfuscated malicious context  Benign Samples Alexa top 50 URLs 7,976 contexts 2011/5/24A Seminar at Advanced Defense Lab20

21. Feature Selection  hand-picked vs. automatically selected 2011/5/24A Seminar at Advanced Defense Lab21

22. Evaluation  HP xw4600 workstation Intel Core2 Duo 3.16 GHz 4 GB memory Windows 7 64-bit Enterprise 2011/5/24A Seminar at Advanced Defense Lab22

23. Effectiveness 2011/5/24A Seminar at Advanced Defense Lab23

24. Training Set Size 2011/5/24A Seminar at Advanced Defense Lab24

25. Feature Set Size 2011/5/24A Seminar at Advanced Defense Lab25

26. Comparison with Other Techniques 2011/5/24A Seminar at Advanced Defense Lab26

27. Performance: Context Size 2011/5/24A Seminar at Advanced Defense Lab27

28. Performance: Feature Set 2011/5/24A Seminar at Advanced Defense Lab28

29. 2011/5/24A Seminar at Advanced Defense Lab29

30. 2011/5/24A Seminar at Advanced Defense Lab30

31. I think these is the all… 2011/5/24A Seminar at Advanced Defense Lab31 unescape(“%48%65%6c%6c%6f%57 %6f%72%6c%64”) “\u0048\u0065\u006C\u006C\u006F \u0057\u006F\u0072\u006C\u0064” document.write(“alert(‘1’)”); eval(“alert(1)”); "H976e246l3l2o19W42o45r7l88d734 ".replace(/[09]/g,"")

32. If I want to eval …  Fucntion("alert(‘1')")(); setTimeout("alert(‘1')“; execScript("alert(‘1')", "javascript"); [].constructor.constructor('alert(1)')(); window["eval"]("alert(‘1’)");  2011/5/24A Seminar at Advanced Defense Lab32

33. In the network, I find …  ([][(![]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[ ]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[] )[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[ +!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[ +[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[] +!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[] ]+(![]+[])[!+[]+!+[]]+(![]+[])[!+[]+!+[]]]()[(![]+[])[+!+[]] +(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+! +[]]+(!![]+[])[+[]]])(+!+[])  2011/5/24A Seminar at Advanced Defense Lab33

34. 2011/5/24A Seminar at Advanced Defense Lab34