8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

1/12

Oiionc Vcedmaekn \cxi|v |k`kl'

skvaim vdkv udiwu diw vdcuc fcvcevaim uquvcgu eigxncgcmv cked

ivdc| vi agx|izc fcvcevaim |kvcu- $5! km amzcuvaokvaim ij vdc eig'

xnctavq ij @kzkUe|axv im vdc wcl kmf diw av |cnkvcu vi czkuaim- $6!

k uvsfq ij wdaed zsnmc|klanavacu dkzc lccm vk|ocvcf lq wcl'lkucf

gknwk|c kmf gckus|c diw vdau gkbcsx dku edkmocf izc| vagc-

Is| kmknquau |kaucu kwk|cmcuu klisv vdc czkuazc vkevaeu vdkv gsuv

lc eimuafc|cf wdcm fczcnixamo ixc|kvaimkn wcl gknwk|c fcvcevaim

uquvcgu-

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

2/12

vk|ocvcf gkq lc fajesnv- Kffavaimknnq. gkmkoamo gsnvaxnc ZG ag'

kocu wavd fajjc|cmv eiglamkvaimu ij ctxniavklnc uijvwk|c eigxi'

mcmvu ekm lc km k|fsisu vkub- L|iwuc| cgsnkvaim dku lccm x|i'

xiucf vi kff|cuu vdcuc udi|veigamou-

L|iwuc| Cgsnkvaim- Amuvckf ij fcxniqamo ZG dimcqxivu. imc ekm

cgsnkvc k l|iwuc| kmf suc fqmkgae kmknquau vi afcmvajq ctxniavu-

@UKMF lq Eizk cv kn- R5W jinniwu vdau kxx|iked kmf cgsnkvcu k

l|iwuc| vi ctv|kev jckvs|cu j|ig wcl xkocu vdkv amfaekvc gknaeaisu

lcdkzai|- XdimcqE R;5W au kmivdc| L|iwuc| Cgsnkvi|- Av amensfcuusxxi|v ji| @kzkUe|axv kmf ZLUe|axv ku wcnn ku vdc klanavq vi am'

uvkmvakvc jkbc KevazcT il`cevu- Gifsncu wavd uaomkvs|cu ji| bmiwm

zsnmc|klanavacu knniw XdimcqE vi fcvcev ctxniavu kokamuv xnsoamu-

L|iwuc| cgsnkvi|u ekm xamxiamv vdc ctxniavcf zsnmc|klanavq kmf

czcm cuvklnaud k edkam ij eksuknavq amensfamo czc|q uamonc wcl |c'

{scuv amzinzcf am k f|azc'lq fiwmnikf- Im vdc ivdc| dkmf. cgsnk'

vi|u ekmmiv fcvcev ctxniav kvvcgxvu kokamuv smbmiwm zsnmc|klanavacu

kmf gsuv lc sxfkvcf vi dkmfnc {sa|bu am gkamuv|ckg l|iwuc|u ku

vdcq k|c faueizc|cf-

\cxsvkvaim Lkucf Fcvcevaim- Am vdc klucmec ij gknaeaisu xkq'

nikfu. av au xiuualnc vi vkbc k eimvcmv'komiuvae kxx|iked vi enkuuajq

wcl xkocu lkucf im vdc |cxsvkvaim ij vdc diuvamo amj|kuv|sevs|c-

Jcncoqdkpa cv kn- nczc|koc FMU x|ixc|vacu vi x|cfaev mcw gknaeaisu

figkamu lkucf im km amavakn uccf R6W- Ncc cv kn- fczcnixcf Miviu. kfqmkgae |cxsvkvaim uquvcg ji| FMU. vdkv ekm ko figkamu ku gkna'

eaisu wccbu lcji|c vdcq kxxck| im xslnae lnkebnauvu R;W- Knvdisod

Miviu au miv gckmv ji| fcvcevamo gknaeaisu wcl xkocu. k uagank|

kxx|iked ekm lc jinniwcf lq kooamo xkocu vdkv amensfc |cuis|ecu

vdkv k|c diuvcf im gknaeaisu figkamu-

Uaomkvs|c Lkucf Fcvcevaim- V|kfavaimkn Kmva'Za|su $KZ! uquvcgu

ixc|kvc lq uekmmamo xkqnikfu ji| bmiwm amfaekvi|u ij gknaeaisu'

mcuu- Vdcuc amfaekvi|u k|c afcmvacf lq KZ uaomkvs|cu. wdaed gsuv

lc eimvamsisunq sxfkvcf vi afcmvajq mcw vd|ckvu- Vqxaeknnq. xkebcf

ctcesvklncu i| DVGN gsuv lc smxkebcf lcji|c xc|ji|gamo gkved'

amo- Ji| wcl xkocu. vdau gaodv amzinzc DVGN xk|uamo i| |sfagcm'

vk|q @kzkUe|axv ctcesvaim- Aj smxkebamo au miv xiuualnc. KZ cmoamcu

gkq ko k lamk|q ku gknaeaisu uincnq lq fcvcevamo vdc x|cucmec ij

vdc xkebc|- Ji| @kzkUe|axv. KZu jiesu im fcvcevamo vdc x|cucmec ijdckzq iljsuekvaim- Ilc|dcafc cv kn- udiwcf vdkv eiglamamo gsnva'

xnc KZ cmoamcu ekm uaomaekmvnq agx|izc vdc fcvcevaim |kvc R;6W-

5- CZKFAMO FCVCEVAIMAm Ucevaim

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

3/12

18Z

:J\SDSZ

3DUT_F_N\[

&1D[@N[DZ

#S\PZDS$XTIF_N\[

PDC

OF_FCFZD

Jaos|c ;0 Vdc fako|kg udiwu k daod'nczcn izc|zacw ij Oiioncu

wcl'gknwk|c fcvcevaim uquvcg- ZGu einncev fkvk j|ig wcl

xkocu kmf uvi|c av am k fkvklkuc ji| kmknquau- XkocUei|c| nczc|'

kocu gsnvaxnc uei|c|u vi fcvc|gamc aj k wcl xkoc au gknaeaisu-

eimvcmv2 ucc Ucevaim 6-;-

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

4/12

8

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

5/12

Jaos|c 60 Vdc dckv gkx udiwu vdc |cnkvazc fauv|alsvaim ij ct'

xniavu cmeismvc|cf im vdc wcl izc| vagc- Czc|q uceimf EZC au

nklcncf im vdc Q'ktau-

ncuu nabcnq ku ctxniavklnc zsnmc|klanavacu wc|c x|cucmv am knn zc|uaimuij Amvc|mcv Ctxni|c| kmf xixsnk| xnsoamu fs|amo vdc eis|uc ij is|

uvsfq- \cok|fncuu ij vdc givazc. uieakn cmoamcc|amo xiucu k e dkn'

ncmoc vi ZG'lkucf dimcqxivu gsuv lc keeismvcf ji|-

Eismvc|gckus|cu- Vdcuc |cusnvu udiw vdkv ZG dimcqxivu wavdisv

suc| amvc|kevaim gkq miv fcvcev wcl xkocu fauv|alsvamo gknwk|c zak

uieakn cmoamcc|amo- Am kffavaim vi uagsnkvamo suc| amvc|kevamo wavd

vdc ZG. imc ekm knui agx|izc fcvcevamo lq xs|usamo k uaomkvs|c

lkucf kxx|iked R;4W-

3-< L|iwuc| Cgsnkvaim Ea|esgzcmvaim_c dqxivdcuapc vdkv f|azc'lq fiwmnikf ekgxkaomu x|agk|anq cg'

xniq vwi vkevaeu vi ea|esgzcmv L|iwuc| Cgsnkvaim0 |kxaf amei|xi'

|kvaim ij pc|i'fkq ctxniavu. kmf dckzq iljsuekvaim vdkv vk|ocvu faj'

jc|cmecu lcvwccm vdc cgsnkvi| kmf k l|iwuc|- _c eimuafc| livd amvdau ucevaim-

Ctxniav V|cmfu- Imec k zsnmc|klanavq lceigcu xslnae. av au {saebnq

amvco|kvcf amvi ctxniav bavu- Ku k |cusnv. L|iwuc| Cgsnkvi|u mccf

vi lc sxfkvcf j|c{scmvnq vi fcvcev mcw zsnmc|klanavacu- Vi daodnaodv

vdc edkmoamo mkvs|c ij ctxniavkvaim im vdc wcl. wc udiw vdc |cnk'

vazc x|czkncmec ij cked ij vdc 3; ctxniavu afcmvacf lq is| L|iwuc|

Cgsnkvi| am Fkvk Ucv AA am Jaos|c 6- _c ucc vdkv

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

6/12

;

;8

;88

;888

;8888

;88888

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

7/12

Jaos|c 10 Vdc dckv gkx udiwu vdc FIG jsmevaimu svanapcf lq

lcmaom wcl xkocu izc| vagc-

Jaos|c ;80 Vdc dckv gkx udiwu vdc FIG jsmevaimu svanapcf lq

ctxniav @kzkUe|axv izc| vagc-

|cucmvu vdc j|kevaim ij uavcu vdkv svanapc vdkv uxceae FIG jsmevaim

i| x|ixc|vq-

Ji| lcmaom xkocu. vdc msglc| ij FIG keecuucu dku ame|ckucf kuvdc wcl dku lceigc gi|c amvc|kevazc kmf jckvs|c |aed- Ji| lcmaom

wcl uavcu. wc mivc vdkv vdc amfaecu ij vdc giuv eiggim jsmevaimu

k|c 5 kmf ;5. wdaed |cjc| vi fiesgcmv-lifq kmf ocvCncgcmvLqAf

|cuxcevazcnq- FIG keecuu xkvvc|mu ji| uavcu vdkv fcnazc| ctxniavu k|c

|cgk|bklnq fajjc|cmv ku uaomaekmvnq jcwc| FIG amvc|kevaimu k|c

jismf- Vwi amfaecu.? kmf 5; uvkmf isv- Vdcq |cjc| vi e|ckvcCncgcmv

kmf ucvKvv|alsvc |cuxcevazcnq- Vdcuc vwi jsmevaimu k|c cg'

xniqcf vi ctxniav GFKE $EZC'

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

8/12

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

9/12

8

38888

;88888

;38888

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

10/12

8

38888

;88888

;38888

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

11/12

8/6/2019 Trends in Circumventing Web-Malware Detection: 2011 Google Report

12/12

ekuc ;0 |"7mje$mifc-edanfMifcuRaW!2 l|ckb2

ekuc 50 |"7mifc-edanfMifcuRaW-mifcZknsc2

|cvs|m |2

zk| mj 7 mje$mifc!Rfiesgcmv-vavncW$,{{,!2

>)ue|axv=

>ue|axv=

wamfiwR,eeeczkneee,-usluv|$5.6!W$,zk| mjYwamfiw7,"mjR6W!2

zk| fkvk 7 ,{{;8{{;;4{{1?R---W,2

zk| fkvkYk||kq 7 fkvkRfiesgcmv-vavncW$,{{,!2

zk| `ue|axv 7 ,,2

ji| $zk| a7;2 a>fkvkYk||kq-ncmovd2 a""!

`ue|axv"7Uv|amoRmjR

zk| nd 7 l-usluv|amo$8. nu )

fcncvc l2

j i| $ a 7 8 2 a > 8 te 82 a "" ! g cgR a W 7 n d " u e2

EinncevOk|lkoc$!2

zk| lkfu|e 7 smcuekxc$

,#s8l8l#s8l8lKKKKKKKKKKKKKKKKKKKKKKKKK,!2

zk| agou 7 mcw K||kq$!2

ji| $zk| a 7 82 a > ;8882 a""!agou-xsud$fiesgcmv-e|ckvcCncgcmv$,ago,!!2

il`; 7 fiesgcmv-e|ckvcCncgcmv$,vlifq,!2

il`;-enaeb2

zk| il`< 7 il`;-enimcMifc$!2

il`;-enck|Kvv|alsvcu$!2

il`; 7 msnn2

EinncevOk|lkoc$!2

ji| $zk| a 7 82 a > agou-ncmovd2 a""!

agouRaW-u|e 7 lkfu|e2

il`dvgn=>dckf=>ue|axv=

zk| czv 7 msnn2

)) UBAXXCF0 Ocmc|kvc udcnneifc kmf vdc ux|kq dckx-

zk| k 7 mcw K||kq$!2

j i| $a 7 8 2 a > )dckf=>lifq=

>uxkm af7,dkmfnc,=>ago u|e7,jii-oaj, imnikf7,cz;$czcmv!, )=

>)uxkm=>)lifq=>)dvgn=

Eifc vi ctxniav vdc lso fcue|alcf lq EZC'