Cache, Trigger, Impersonate: Enabling Context Sensitive Honeyclient Analysis On the Wire
Today's sophisticated web exploit kits use polymorphic techniques to obfuscate each attack instance, making content based signatures used by network intrusion detection systems far less effective than in years past. A dynamic analysis, or honeyclient analysis, of these exploits plays a key role in initially identifying new attacks in order to generate content signatures. While honeyclients can sweep the web for attacks, they provide no means of inspecting end user traffic on the wire to identify attacks in real time. This leaves network operators dependent on third party signatures that arrive too late, or not at all. In this paper, we introduce the design and implementation of a novel framework for adapting honeyclient based systems to operate on the wire at scale. Specifically, we capture and store a configurable window of reassembled HTTP objects networkwide, use lightweight content rendering to establish the chain of requests leading up to a suspicious event, then serve the initial response content back to the honeyclient system on an isolated network. We demonstrate the power of our framework by analyzing a diverse collection of web based exploit kits as they evolve over a one year period. Our case studies provide several interesting insights into the behavior of these exploit kits. Additionally, our empirical evaluations suggest that our approach offers significant operational value, and a single honeyclient server can readily support a large campus deployment.
NDSS