Botconf 2017 has ended
View analytic
Thursday, December 7 • 10:20 - 10:50
Malware Uncertainty Principle: an Alteration of Malware Behavior by Close Observation

Log in to save this to your schedule and see who's attending!

Feedback form is now closed.
During the last couple of years there has been an important surge on the use of HTTPs by malware. The exact reason for this increase is not completely understood yet, but it is hypothesized that it was forced by organizations only allowing web traffic to the Internet and that using HTTPs makes the malware similar to normal connections. Therefore, there has been a growing interest in understanding the usage of HTTPs by malware. This paper describes our research to obtain large quantities of real malware traffic using HTTPs, our use of man-in-the-middle HTTPs interceptor proxies to open and study the content and our analysis of how the behavior of the malware changes after being intercepted. Our research goal is to understand the use of HTTPs in malware traffic and the impact of intercepting its traffic. After our analysis we conclude that the use of a interceptor proxy in a network should be carefully considered.


Maria Jose Erquiaga

My research experience has been mostly focused on studying the behavior of malware in the network. In particular, the behavior of large botnets in real networks. I researched and worked capturing large quantities of malware traffic for long period of times (available to download... Read More →

Thursday December 7, 2017 10:20 - 10:50
Corum Allée du Saint-Esprit, 34000 Montpellier, France