MSc Information Security: Malicious Activity Detection Project

This project focuses on detecting and analyzing malicious activities occurring between a server and mobile phones, primarily leveraging a Man-in-the-Middle (MITM) proxy and command and control (C&C) techniques. The core problem addressed is the unauthorized theft of sensitive information from clients. The proposed solution involves detecting malware activity through the analysis of transmitted packets exchanged between the server and mobile devices. The project aims to inform clients about potential malware threats and investigates data exfiltration attempts from mobile phones. The MITM proxy is employed to capture and analyze mobile-server communications, serving as a crucial tool for identifying malicious patterns. The project includes a literature review on relevant topics like botnets and various malware detection techniques. It also explores security methods, including data availability, authentication, confidentiality, integrity, and non-repudiation, as well as the use of MANETs. The project further delves into the working principles of the MITM proxy, discussing its capabilities in intercepting and manipulating network traffic. The overall goal is to enhance security by identifying and mitigating threats related to malicious activities.

INFORMATION SECURITY

Executive Summary
This project aims to detect and analyze the malicious activities between the server and
mobile phone, and this process is performed by making use of MITM proxy along with the use
of command and controls. This paper will discuss the problem based on the attackers, where they
steal vital information without the consent of the clients. So, this problem requires to be resolved
by detection of malware activity based on analysis of transmitted packets, between the server and
the mobile phones. This project aims to protect and inform the clients about the malware activity.
It also investigates the exfiltration of the data from the user mobile phones. The MITM proxy is
used to capture the packets and analyzes the mobile server communications to protect and inform
the clients about the malicious activities. The Man-in-the-Middle (MITM) proxy makes the
assignment to keep the information safe and secure which is complex because the proxy could be
mounted from the remote Personal computers with counterfeit locations. Therefore, interchanges
in security was to break the encryption changes. In the verification conventions, the
shortcomings are misused by MITM proxy, which are being used by the conveying parties. As
most part relates to validation, by the outsiders who issues the authentications, then the
arrangement of testament age turns into another wellspring of potential shortcoming. In this
paper, we will examine HTTPS-HTTP over SSL/TLS, the most widely recognized scrambled
system movement conventions. In a correspondence scrambled by SSL/TLS, the hosts need to
first concede with the encryption techniques and their parameters. Along these lines, the
underlying bundles contain decoded messages with data about the customer and server. This data
shifts among various customers and their renditions. The comparable customer identifier is User
Agent esteem in a HTTP header, which is usually utilized for recognizing the customer and for
characterizing the movement. It is intended to identify security threats in view of the conduct of
malware tests. The detection of malware activity based on analysis of transmitted packets
between the server and the mobile phones. It also investigates the exfiltration of the data from
the user mobile phones.
2

Table of Contents
1 Introduction..............................................................................................................................4
1.1 Project Goals.....................................................................................................................4
1.2 Problem Statement............................................................................................................4
1.3 Background of the MITM proxy.......................................................................................5
1.4 Detecting the Malicious Traffic between the Server and Clients.....................................6
2 Literature Review....................................................................................................................8
3 Analysis.................................................................................................................................15
3.1 Botnet..............................................................................................................................15
3.2 Aspects of Botnet............................................................................................................17
3.2.1 Platform of operation...............................................................................................17
3.2.2 Detection..................................................................................................................18
3.2.3 Takedown................................................................................................................19
3.2.4 SMS propagation.....................................................................................................19
3.3 Various kinds of IRC based products.............................................................................20
3.4 Solution Malware Detection Techniques........................................................................21
3.5 Security Methods and services........................................................................................26
3.5.1 Data availability.......................................................................................................28
3.5.2 Authentication..........................................................................................................28
3.5.3 Confidentiality.........................................................................................................29
3.5.4 Integrity....................................................................................................................29
3.5.5 Non-repudiation.......................................................................................................30
3.6 MANET..........................................................................................................................31
3.7 Working for MITM Proxy..............................................................................................31
3

4 Discussion..............................................................................................................................33
5 Conclusion.............................................................................................................................35
References......................................................................................................................................38
4

1 Introduction
This project is about detecting and analyzing the malicious activities between the server
and the mobile phones. This process is completed by making the user of MITM proxy and by
using the commands and controls. This paper will discuss the problem based on the attackers,
where they steal vital information without the consent of the clients. So, this problem requires to
be resolved by detection of malware activity based on analysis of transmitted packets, between
the server and the mobile phones. This project aims to protect and inform the clients about the
malware activity. It also investigates the exfiltration of the data from the user mobile phones.
The main objectives of this project are to protect and inform the clients about the malware
activities. This project also investigates the exfiltration of the data from the user mobile phones.
The MITM proxy is used to capture the packets and analyzes the mobile server communications
to protect and inform the clients about the malicious activities.
1.1 Project Goals
The project goal is to protect and inform the clients about the malware activities. It detects
and analyzes the malicious activities between the server and the mobile phone, by using the
MITM proxy software and the MITM proxy is used to capture the packets and analyzes the
mobile server communications to protect and inform the clients about the malicious activities.
The detection of malware activity is based on the analysis of transmitted packets between the
server and mobile phones. It also investigates the exfiltration of the data from the user mobile
phones.
1.2 Problem Statement
This paper discusses the problem based on the attackers, where they steal vital information
without the consent of the clients. So, this problem requires to be resolved by detection of
malware activity based on analysis of transmitted packets, between the server and the mobile
phones. This process is done by making the user of MITM proxy and use of command and
controls. The MITM proxy is used to capture the packets and analyzes the mobile server
communications to protect and inform the clients about the malicious activities.
5

1.3 Background of the MITM proxy
Mitmproxy is "man-in-the-middle" that enables you to capture HTTP and HTTPS activity -
and last by manufacturing the SSL endorsements. This is extraordinarily helpful for
troubleshooting and arranges issues, particularly in the light of the fact that instruments, for
example, ethereal are unequipped for sniffing the HTTPS movement. Likewise, mitmproxy
permits altering the activity, enabling you to counterfeit system mistakes. Lamentably, the
mitmproxy variant packaged with Ubuntu (bent introduce mitmproxy) is excessively old - the
SSL declaration producing does not work accurately. Mitmproxy can decode scrambled activity
on the fly, as long as the customer confides in its implicit authentication expert. Generally, this
implies the mitmproxy CA declarations must be introduced on the customer gadget. Mitmproxy
is a support instrument that permits intelligent examination and change of HTTP movement. It
varies from mitmdump in that, all the streams are kept in memory, which implies that it's
proposed for taking and controlling smallish examples. Since mitmproxy is running, we have to
arrange issues. There are two things we have to change (Boyd and Simpson, 2013):
 Movement needs to go through the intermediary. For this, we utilize the intermediary
mandate
 We require httplib2 to acknowledge the manufactured declaration. We accordingly
instruct it to acknowledge mitmproxy as authentication specialist.
Man-in-the-Middle (MITM) proxy makes the assignment of securing the information, which
is complex because the proxy could be mounted from the remote Personal computers with
counterfeit locations. Therefore, interchanges in security was to break the encryption changes. In
the verification conventions, the shortcomings are misused by MITM proxy, which are being
used by the conveying parties. As most part relates to validation, by the outsiders who issues the
authentications, then the testament age arrangement turns into another wellspring of potential
shortcoming (Lee, 2012). The MITM proxy allows the interloper or the unapproved gathering to
snoop on information through the secondary passage. This intercession is additionally being
utilized by organizations to inquire upon their representatives and for adware. For instance, in
mid 2015, it was found that Lenovo PCs came preinstalled with adware called Super fish that
infuses promoting on programs, for example, Google Chrome and Web Explorer. Super fish
introduces a self-created root testament into the Windows endorsement store and after that leaves
all SSL declarations displayed by HTTPS destinations with its own particular authentication.
6

This could enable programmers to possibly take delicate information like saving money
qualifications or to keep an eye on the clients' exercises. Cryptographic conventions intended to
give interchanges security over a PC arranges are a piece of Transport Layer Security (TLS)
(Kranakis, Haroutunian and Shahbazian, 2008). These conventions utilize X.509 which is an
ITU-T standard that determines standard arrangements for open key endorsements,
authentication denial records, quality declarations, and an accreditation way approval
calculation. The X.509 testaments are utilized for confirmation the counter party and to arrange a
symmetric key. As specified, authentication experts are a frail connection inside the security
framework. In electronic mail, in spite of the fact that servers do require SSL encryption,
substance are prepared and put away in plain content on the servers (Muniz and Lakhani, 2013).
The MITM proxy allows the gatecrasher or the unapproved assembling from snooping on the
data via, an optional entry. Such mediation is used by associations for interfering with their
agents and for adware. For example, during the middle of the year 2015, there was a discovery
that, the Lenovo Personal Computers originated with preinstalled adware known as, Super fish
which implants programs’ promotion. For instance, the Web Explorer and the Google Chrome.
Super fish presents a self-made root testament for supporting the Windows support store. Later,
all the SSL declarations displayed by the goals of HTTPS with its own specific verification.
Thus, it could empower the software engineers to perhaps take sensitive data such as saving
money qualifications or to watch out for the customers' activities. The cryptographic traditions
proposed to provide interchanges in security over the Personal Computers arranges are a bit of
Transport Layer Security (TLS) (Kranakis, Haroutunian and Shahbazian, 2008). Such
conventions utilize X.509 that is an ITU-T standard, which decides the standard game plans for
the open key endorsements, authentication denial records, quality declarations, along with
accreditation way of approval estimation. The testaments of X.509 are used to affirm the counter
party and to organize a symmetric key. As specified, within the security framework, the
authentication experts are quite a fragile association. In electronic mail, despite that the servers
need the SSL encryption, the substance are prepared and secured in plain content on the servers
(Muniz and Lakhani, 2013).
Features
1. Catch HTTP solicitations and reactions, then adjust them on the fly.
7

2. Spare finish HTTP discussions for later replay and examination.
3. Replay the customer side of HTTP discussions.
4. Replay HTTP reactions of a formerly recorded server.
5. Invert intermediary mode to forward activity to a predefined server.
6. Straightforward intermediary mode on OSX and Linux.
7. Roll out scripted improvements to HTTP activity utilizing Python.
8. SSL authentications for capture attempt are created on the fly.
9. Furthermore, a whole lot more.
1.4 Detecting the Malicious Traffic between the Server and Clients
The rising fame of encoded organize movement is a twofold edged sword. From one
perspective, it gives secure information transmission, ensures against spying, and enhances the
dependability of conveying. Then again, it entangles the authentic checking of system activity,
including movement order and host ID. These days, we can screen, recognize, and order plain-
content system movement, for example, HTTP; however it is difficult to break down encoded
correspondence. The more secure the association is, from the perspective of imparting
accomplices, the harder it is to comprehend the system movement and distinguish odd and
malicious action. Besides, malicious system conduct can be covered up in encoded associations,
where it is imperceptible to identification instruments (Verma and Dixit, 2016).
In this paper, we will examine HTTPS-HTTP over SSL/TLS, the most widely recognized
scrambled system movement conventions. In a correspondence scrambled by SSL/TLS, the hosts
need to first concede to encryption techniques and their parameters. Along these lines, the
underlying bundles contain decoded messages with data about the customer and server. This data
shifts among various customers and their renditions. The comparable customer identifier is User
Agent esteem in a HTTP header, which is usually utilized for recognizing the customer and
characterizing movement. Be that as it may, just the SSL/TLS handshake can be seen in a
HTTPS association without decoding the payload. In this way, we approach the issue of
distinguishing the SSL/TLS customer and grouping HTTPS activity by working up a word
reference of SSL/TLS handshake fingerprints and their comparing User-Agents and it uses the
generic classification system. It is intended to identify security threats in view of the conduct of
malware tests. The framework depends on factual highlights figured from intermediary log fields
8

to prepare identifiers utilizing a database of malware tests. The conduct identifiers fill in as
fundamental reusable building squares of the multi-level location design. The finders distinguish
malignant correspondence misusing scrambled URL strings and spaces created by a Domain
Generation Algorithm (DGA) which are much of the time utilized as a part of Command and
Control (C&C), phishing, and click misrepresentation. Shockingly, extremely exact locators can
be constructed given just a restricted measure of data removed from a solitary intermediary log.
Moreover, a correlation with a mark and decide based arrangement demonstrates that our
framework can identify noteworthy measure of new threats. We need to comprehend the system
movement before we can continue to customer recognizable proof and identification of
suspicious or even malicious action. Subsequently, we need to watch organize movement to get
knowledge into ordinary examples (Verma and Dixit, 2016). In particular, for this situation, we
need to recover record of scrambled system movement containing however much extraordinary
examples as could reasonably be expected. To inspire our work, we chose to break down genuine
system movement in a system as opposed to producing the activity designs in research center
condition. Consequently, we can get all more intriguing which is not really identified with the
proposed test. These outcomes can later be helpful for organizing the executives, security
professionals, and for academic network. We need to recognize what are the choices of building
up the SSL/TLS correspondence and which alternatives are utilized as a part of genuine
movement. We need to utilize techniques as essential genuine system information to recognize
these alternatives. At that point, we need to discover which of the alternatives are fluctuating the
most and on the off chance that the changeability of these choices demonstrates distinctive
movement designs, e.g., diverse conveying accomplices or sort of activity (Verma and Dixit,
2016).
The strategies in view of statistical features removed from the proxy log fields have
demonstrated the guarantee of identifying malware practices of various malware families. The
location calculations depend on the way that a foe needs to speak with the tainted host. For
instance, in phishing or snap misrepresentation, stolen accreditations or delicate private
information are exchanged to the bot master. The bot master may utilize a force style Command
and Control (C&C) to download (pull) charges from remote servers by the bots (Kotipalli and
Imran, 2016).
9

2 Literature Review
According to this paper (Fukuda, Heidemann and Qadeer, 2017), Network-wide activity is
the point at which one PC (the originator) contacts numerous others (the objectives). Thought
processes in action might be favorable (mailing records, CDNs, and research checking),
malignant (spammers and scanners for security vulnerabilities), or maybe uncertain
(advertisement trackers). Learning of Malicious action may help foresee attacks, and
understanding considerate action may set a pattern or describe development. This paper
distinguishes DNS backscatter as another wellspring of data about system wide movement.
Backscatter is the switch DNS inquiries caused when targets or middle boxes naturally look into
the area name of the originator. Questions are obvious to the legitimate DNS servers that handle
turn around DNS. While the division of backscatter they see relies upon the server's area in the
DNS pecking order, we demonstrate that movement that contacts numerous targets seem even in
inspected perceptions. We utilize data about the queries to group originator movement utilizing
machine learning. Utilizing this procedure we inspect nine months of action from one specialist
to distinguish inclines in filtering, recognizing blasts comparing to Heart bleed and expansive
and constant checking of ssh. This paper distinguishes another wellspring of data on organizing
wide action: DNS backscatter, the invert DNS inquiries activated by such action. Exercises of
intrigue are those that touch numerous Internet gadgets, including Malicious or possibly noxious
action, for example, spamming and examining, and also far reaching administrations, for
example, CDNs, programming updates, and web slithering. These exercises trigger turn around
DNS questions as firewalls, middle boxes, and servers (queries) resolve mapping of the IP
deliver of the originator to DNS name during the time spent logging or host based verification.
Legitimate DNS servers give a state of convergence of these questions that permits recognition
of extensive exercises. Since backscatter happens for the most part as mechanized procedures,
and we think about just originators with numerous queries, our approach maintains a strategic
distance from activity from people thus has negligible protection concerns. Since backscatter is
created by the objectives of system movement, not the originator, an antagonistic originator can't
keep its age. Investigation of DNS activity raises potential security issues, since it frequently
starts from movement by people. Our approach limits these worries for a few reasons. To start
with, the information sources we utilize inherently veil the perceivability and personality of
people. Reserving vigorously weakens all inquiries seen by the expert, and a mutual store
10

darkens the character of any person. We see organizing wide action simply because of its
numerous objectives, while action of any given individual is to a great degree far-fetched to
show up. Second, specialists have practically zero direct contact with people because of
indirection from recursive resolvers. At long last, while crude information at an expert is a blend
of individual and mechanized movement, the switch inquiries. We consider almost all robotized.
People regularly utilize DNS to delineate to addresses; every single turn around inquiry is from
robotized sources.
This paper says (Wang et al., 2012), since the web came into life in the 1970s it has been
developing by over 100% consistently. Notwithstanding, strategies for recognizing system
interruption have been far outpaced. Existing interruption location and avoidance strategies need
exactness, expansive attack scope, speed, execution, and versatility. They don't give dependable
assurance to the present indispensable systems. The monetary effect of pernicious attacks in lost
income to a solitary internet business organization can fluctuate from thousand up to 53 million
US dollars. In the meantime, there is no compelling scientific model broadly accessible to
recognize bizarre system conduct, for example, port filtering, framework investigating, infection
and worm proliferation from ordinary movement. Irregular's Knowledge will likely build up
another discovery strategy that beats different strategies, including design coordinating, neural
systems and measurable procedures. This recognition framework, Port scan Detection System
(PDS), recognizes and restricts activity designs reliable with potentially stealthy types of attacks
from inside crowds of authentic movement. With the systems parcel activity stream being its
info, PDS depends on high devotion models of typical movement spill out of which it can
basically judge the authenticity of any sub stream of bundle activity. We focus on giving a solid
model to honest to goodness web movement, by which malicious action might be recognized. A
characteristic decision for a numerical model of (genuine) web movement is a non-homogeneous
Poisson process. One technique used to recognize powerless ports of a system benefit framework
is to send a grouping of examining parcels to every single accessible port over a moderately brief
timeframe. This observation conduct distinguishes which ports of a system are open and which
administrations have been made accessible. In the customary system activity display utilizing
parcels, port examining takes up a minor part of the movement and is hard to identify. By
gathering the bundles of every session together a testing session will abuse the supposition of
freedom of entry times over the ports of the system. This infringement of freedom enables one to
11

recognize this kind of vindictive conduct effectively. To legitimize the utilization of the Poisson
procedure display we take note of that the sessions speaking to various administration demands
are free occasions. Anyway it is realized that the landing rate can be viewed as steady just
finished a generally short (roughly five moment) interim. Augmentations past this short interim
don't display the present day servers extremely well.
This paper describes (Ham and Lee, 2014) that, the different kinds of portable applications
are utilized paying little mind to time and place, as various Android cell phone clients have been
as of late expanded. Be that as it may, the break of security through unlawful spillage of
individual data and money related data inside cell phones has happened without clients'
notification, as the malignant versatile application is generally expanding keeping in mind the
end goal to diminish the harm caused by the vindictive Android applications, the productive
recognition component ought to be created to decide typical and pernicious applications
accurately. In this paper, we collected ongoing framework call occasions enacted from malware
tests conveyed by Android Malware Genome Project. In the wake of removing the essential
contrast highlight and qualities of framework call occasions design from every typical and
noxious applications, we can decide if any given unknown versatile application is pernicious or
ordinary one. The procedural examination uncovers that the client gadgets will get contaminated
with Malicious codes and prompts the issues rerouting key data to outer servers with which
interloper determined through the changes of access authorization, once clients run the projects
which were downloaded from open market or illegal businesses. Portable Malicious applications
in view of Android which releases the individual and budgetary data by causing glitch and
devouring the batteries of gadgets have reliably been expanding. In this manner, strategies
checking pernicious application occasions have been introduced to recognize the interruption
toward cell phones in an offer to diminish harms through spread of Malicious application like
this, yet component ought to be created to separate malignant applications from typical
applications of business cell phones. Location strategies for attacks on cell phones have been
proposed to diminish the weakness from malignant portable applications. Be that as it may, a
propelled component that gives more improved methods for ordering malignant applications on
regular cell phones ought to be created. In to begin with, it is important to break down the attack
component in view of the ongoing security vulnerabilities of Android-based cell phones, and
investigations the qualities of malignant applications with actuation design utilizing Linux
12