Sciweavers

ACSAC
2007
IEEE

HoneyIM: Fast Detection and Suppression of Instant Messaging Malware in Enterprise-Like Networks

14 years 4 months ago
HoneyIM: Fast Detection and Suppression of Instant Messaging Malware in Enterprise-Like Networks
Instant messaging (IM) has been one of most frequently used malware attack vectors due to its popularity. Distinct from other malware, it is straightforward for IM malware to find and hit the next victim by exploiting the current victim’s contact list and playing social engineering tricks. Thus, the spread of IM malware is much harder to detect and suppress through conventional approaches. The previous solutions are ineffective to defend against IM malware in an enterprise-like network environment, mainly because of high false positive rate and the requirement of the IM server being inside the protected network. In this paper, we propose a novel IM malware detection and suppression mechanism, HoneyIM, which guarantees almost zero false positive on detecting and blocking IM malware in an enterprise-like network. The detection of HoneyIM is based on the concept of honeypot. HoneyIM uses decoy accounts to trap IM malware by leveraging malware spreading characteristics. Fed with accura...
Mengjun Xie, Zhenyu Wu, Haining Wang
Added 02 Jun 2010
Updated 02 Jun 2010
Type Conference
Year 2007
Where ACSAC
Authors Mengjun Xie, Zhenyu Wu, Haining Wang
Comments (0)