Další formáty:
BibTeX
LaTeX
RIS
@inproceedings{1420766,
author = {Ghafir, Ibrahim and Přenosil, Václav and Hammoudeh, Mohammad and AparicioandNavarro, Francisco J. and Rabie, Khaled and Jabban, Ahmad},
address = {Amman, Jordan},
booktitle = {Proceedings of International Conference on Future Networks and Distributed Systems},
doi = {http://dx.doi.org/10.1145/3231053.3231097},
keywords = {Cyber attacks; advanced persistent threat; spear-phishing emails; disguised executable file; malware; intrusion detection system.},
howpublished = {tištěná verze "print"},
language = {eng},
location = {Amman, Jordan},
isbn = {978-1-4503-6428-7},
pages = {1-5},
publisher = {ACM Digital Library},
title = {Disguised Executable Files in Spear-Phishing Emails: Detecting the Point of Entry in Advanced Persistent Threat},
year = {2018}
}
TY - JOUR
ID - 1420766
AU - Ghafir, Ibrahim - Přenosil, Václav - Hammoudeh, Mohammad - Aparicio-Navarro, Francisco J. - Rabie, Khaled - Jabban, Ahmad
PY - 2018
TI - Disguised Executable Files in Spear-Phishing Emails: Detecting the Point of Entry in Advanced Persistent Threat
PB - ACM Digital Library
CY - Amman, Jordan
SN - 9781450364287
KW - Cyber attacks
KW - advanced persistent threat
KW - spear-phishing emails
KW - disguised executable file
KW - malware
KW - intrusion detection system.
N2 - In recent years, cyber attacks have caused substantial financial losses and been able to stop fundamental public services. Among the serious attacks, Advanced Persistent Threat (APT) has emerged as a big challenge to the cyber security hitting selected companies and organisations. The main objectives of APT are data exfiltration and intelligence appropriation. As part of the APT life cycle, an attacker creates a Point of Entry (PoE) to the target network. This is usually achieved by installing malware on the targeted machine to leave a back-door open for future access. A common technique employed to breach into the network, which involves the use of social engineering, is the spear phishing email. These phishing emails may contain disguised executable files. This paper presents the disguised executable file detection (DeFD) module, which aims at detecting disguised exe files transferred over the network connections. The detection is based on a comparison between the MIME type of the transferred file and the file name extension. This module was experimentally evaluated and the results show a successful detection of disguised executable files.
ER -
GHAFIR, Ibrahim, Václav PŘENOSIL, Mohammad HAMMOUDEH, Francisco J. APARICIO-NAVARRO, Khaled RABIE a Ahmad JABBAN. Disguised Executable Files in Spear-Phishing Emails: Detecting the Point of Entry in Advanced Persistent Threat. In \textit{Proceedings of International Conference on Future Networks and Distributed Systems}. Amman, Jordan: ACM Digital Library, 2018, s.~1-5. ISBN~978-1-4503-6428-7. Dostupné z: https://dx.doi.org/10.1145/3231053.3231097.
|
