Automatic Extraction of Indicators of Compromise for Web App.
summary
Automated system extracts and validates web Indicators of Compromise by instrumenting a high-interaction honeypot of 500 vulnerable domains, diffing VM snapshots to capture modified files, then clustering JavaScript URLs with five features (page similarity, maliciousness scores, anomalous origin, popularity, forum mentions). Deployment yields about 2.5 unique IOCs per day and 300 candidates with 22 confirmed malicious, 90% previously unseen by AV vendors, and it successfully surfaces defacements, web shells, phishing kits, affiliate click-fraud and server-side traffic redirection.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:23Title
- 1:53What is indicator of compromise
- 3:40Automatic extraction of indicators of compromise
- 4:10Backgrounds
- 7:50Web indicator of compromise
- 10:46Detecting malicious code
- 10:59What we do
- 14:48Google
- 23:19Results
- 24:20Lifetime of malicious indicators
- 25:41Webshells
- 27:33Fishing Kit
- 29:39Affiliate Programs
- 32:57Mailers
- 34:47Alternative approach
- 35:45Conclusion
related talks
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
31mWeb Application Honeypot Threat Intelligence
32mAutomating Web Application Bug Hunting
26mLooking at 4 years of web honeypot attacks: tactics, ...
30mTrawling for IOCs: Catching C2 in a Sea of Data
35mAI-Powered Bug Hunting
25mThe Voight-Kampff Test for Discovering Vulnerabilities
26mStrategic Web Compromises in the Middle East with a Pinch of Candiru