Greetz from academe: Content-Agnostic Malware Protection

‘CAMP: Content-Agnostic Malware Protection’ [1] was presented at NDSS, the Network and Distributed System Security Symposium [2], in February 2013, and published by the organizer of the event, the Internet Society. The five authors (although perhaps ‘campers’ would be a better term) are all affiliated with Google.

As a glimpse into academic publishing, NDSS itself is a well-established venue: this year was the 20th time the Symposium had been run, and it has a consistently low acceptance rate for papers – just under 19% this year. Full papers are submitted for review, so when referees read and rank the papers they are essentially judging the finished product.

In summary, what CAMP does is extend Google’s Chrome browser. When a user downloads a binary when using Chrome+CAMP, the browser decides if the binary is naughty or nice by applying three checks. First, it uses a blacklist, where the binary’s URL is compared against a list of known malicious URLs. Second, a whitelist comes into play; domains and code signers that have refrained from pumping out malware for three months are whitelisted. The first two checks are performed locally and, arguably, the underlying basis of these lists is one of reputation. Finally, if no definitive decision can be made based on the first two checks, attributes of the binary and its location are launched into the cloud for a reputation assessment with a more global view.

Academic papers should always give enough detail for the work to be repeated, in theory, and the CAMP paper doesn’t disappoint; there are many goodies to be mined from the paper both about CAMP’s implementation and about its extremely high accuracy.

The paper rang a bell for me when I read it, because it reminded me of a very interesting talk I heard at VB2009 by researchers from Symantec about detecting malware with... wait for it... reputation [3]. The CAMP paper doesn’t cite this work, but it does mention Microsoft’s SmartScreen Application Reputation system in IE 9 [4], [5]. The authors characterize SmartScreen as ‘closely related to our work’, which is academic-speak for ‘let the hair splitting begin’.

On the surface, Google would appear to be the latecomer to the reputation party, but it could also be seen the other way around: the company’s bread-and-butter PageRank algorithm is really just a type of reputation score, albeit applied in a different context. Context can be critical, of course, and in the meantime I see that a number of related patents and patent applications for reputation-based malware detection have appeared. A quick search for a few of the usual suspects turned up some Symantec patents for malware detection [6], [7] and reducing false positives [8] with reputation, and some Microsoft patent applications for reputation based malware detection [9], [10]. (I should point out that I’m not a lawyer, and I’m not making any judgement about the claims of these patents. I’m mentioning them merely to connect up some related work.)

Reputation seems to be here to stay. Given the title of this column, I should probably end the first instalment with a shout-out to my academic homies or something, but so far they have all been strangely reluctant to disclose their handles; for now, I’ll have to stick with the secret academic handshake.