HoneyID: Unveiling hidden spywares by generating bogus events

Jeheon Han, Jonghoon Kwon, Heejo Lee

Research output: Chapter in Book/Report/Conference proceedingConference contribution

8 Citations (Scopus)

Abstract

A particular type of spyware which uses the user's events covertly, such as keyloggers and password stealers, has become a big threat to Internet users. Due to the prevalence of spywares, the user's private information can easily be exposed to an attacker. Conventional anti-spyware programs have used signatures to defend against spywares. Unfortunately, this mechanism cannot detect unknown spywares. In this paper, we propose a spyware detection mechanism, called HoneyID, which can detect unknown spywares using an enticement strategy. HoneyID generates bogus events to trigger the spyware's actions and then detects hidden spywares among running processes which operate abnormally.We implemented the HoneyID mechanism as a windows based, and evaluated it's effectiveness against 6 different known spywares(3 keyloggers and 3 ftp password sniffers). From this study, we show that the HoneyID can be effective to detect unknown spywares with high accuracy.

Original languageEnglish
Title of host publicationIFIP International Federation for Information Processing
Pages669-673
Number of pages5
Volume278
DOIs
Publication statusPublished - 2008 Aug 4

Publication series

NameIFIP International Federation for Information Processing
Volume278
ISSN (Print)15715736

Fingerprint

World Wide Web
Threat
Private information
Trigger

ASJC Scopus subject areas

  • Information Systems and Management

Cite this

Han, J., Kwon, J., & Lee, H. (2008). HoneyID: Unveiling hidden spywares by generating bogus events. In IFIP International Federation for Information Processing (Vol. 278, pp. 669-673). (IFIP International Federation for Information Processing; Vol. 278). https://doi.org/10.1007/978-0-387-09699-5_43

HoneyID : Unveiling hidden spywares by generating bogus events. / Han, Jeheon; Kwon, Jonghoon; Lee, Heejo.

IFIP International Federation for Information Processing. Vol. 278 2008. p. 669-673 (IFIP International Federation for Information Processing; Vol. 278).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Han, J, Kwon, J & Lee, H 2008, HoneyID: Unveiling hidden spywares by generating bogus events. in IFIP International Federation for Information Processing. vol. 278, IFIP International Federation for Information Processing, vol. 278, pp. 669-673. https://doi.org/10.1007/978-0-387-09699-5_43
Han J, Kwon J, Lee H. HoneyID: Unveiling hidden spywares by generating bogus events. In IFIP International Federation for Information Processing. Vol. 278. 2008. p. 669-673. (IFIP International Federation for Information Processing). https://doi.org/10.1007/978-0-387-09699-5_43
Han, Jeheon ; Kwon, Jonghoon ; Lee, Heejo. / HoneyID : Unveiling hidden spywares by generating bogus events. IFIP International Federation for Information Processing. Vol. 278 2008. pp. 669-673 (IFIP International Federation for Information Processing).
@inproceedings{f8fb831e2caa4f6bb4ae351565264420,
title = "HoneyID: Unveiling hidden spywares by generating bogus events",
abstract = "A particular type of spyware which uses the user's events covertly, such as keyloggers and password stealers, has become a big threat to Internet users. Due to the prevalence of spywares, the user's private information can easily be exposed to an attacker. Conventional anti-spyware programs have used signatures to defend against spywares. Unfortunately, this mechanism cannot detect unknown spywares. In this paper, we propose a spyware detection mechanism, called HoneyID, which can detect unknown spywares using an enticement strategy. HoneyID generates bogus events to trigger the spyware's actions and then detects hidden spywares among running processes which operate abnormally.We implemented the HoneyID mechanism as a windows based, and evaluated it's effectiveness against 6 different known spywares(3 keyloggers and 3 ftp password sniffers). From this study, we show that the HoneyID can be effective to detect unknown spywares with high accuracy.",
author = "Jeheon Han and Jonghoon Kwon and Heejo Lee",
year = "2008",
month = "8",
day = "4",
doi = "10.1007/978-0-387-09699-5_43",
language = "English",
isbn = "9780387096988",
volume = "278",
series = "IFIP International Federation for Information Processing",
pages = "669--673",
booktitle = "IFIP International Federation for Information Processing",

}

TY - GEN

T1 - HoneyID

T2 - Unveiling hidden spywares by generating bogus events

AU - Han, Jeheon

AU - Kwon, Jonghoon

AU - Lee, Heejo

PY - 2008/8/4

Y1 - 2008/8/4

N2 - A particular type of spyware which uses the user's events covertly, such as keyloggers and password stealers, has become a big threat to Internet users. Due to the prevalence of spywares, the user's private information can easily be exposed to an attacker. Conventional anti-spyware programs have used signatures to defend against spywares. Unfortunately, this mechanism cannot detect unknown spywares. In this paper, we propose a spyware detection mechanism, called HoneyID, which can detect unknown spywares using an enticement strategy. HoneyID generates bogus events to trigger the spyware's actions and then detects hidden spywares among running processes which operate abnormally.We implemented the HoneyID mechanism as a windows based, and evaluated it's effectiveness against 6 different known spywares(3 keyloggers and 3 ftp password sniffers). From this study, we show that the HoneyID can be effective to detect unknown spywares with high accuracy.

AB - A particular type of spyware which uses the user's events covertly, such as keyloggers and password stealers, has become a big threat to Internet users. Due to the prevalence of spywares, the user's private information can easily be exposed to an attacker. Conventional anti-spyware programs have used signatures to defend against spywares. Unfortunately, this mechanism cannot detect unknown spywares. In this paper, we propose a spyware detection mechanism, called HoneyID, which can detect unknown spywares using an enticement strategy. HoneyID generates bogus events to trigger the spyware's actions and then detects hidden spywares among running processes which operate abnormally.We implemented the HoneyID mechanism as a windows based, and evaluated it's effectiveness against 6 different known spywares(3 keyloggers and 3 ftp password sniffers). From this study, we show that the HoneyID can be effective to detect unknown spywares with high accuracy.

UR - http://www.scopus.com/inward/record.url?scp=48249085284&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=48249085284&partnerID=8YFLogxK

U2 - 10.1007/978-0-387-09699-5_43

DO - 10.1007/978-0-387-09699-5_43

M3 - Conference contribution

AN - SCOPUS:48249085284

SN - 9780387096988

VL - 278

T3 - IFIP International Federation for Information Processing

SP - 669

EP - 673

BT - IFIP International Federation for Information Processing

ER -