e-space
Manchester Metropolitan University's Research Repository

    Disguised Executable Files in Spear-Phishing Emails: Detecting the Point of Entry in Advanced Persistent Threat

    Ghafir, I, Prenosil, V, Hammoudeh, M, Aparicio-Navarro, F, Rabie, KM and Jabban, A (2018) Disguised Executable Files in Spear-Phishing Emails: Detecting the Point of Entry in Advanced Persistent Threat. In: International Conference on Future Networks and Distributed Systems (ICFNDS), 26 June 2018 - 27 June 2018, Amman, Jordan.

    [img]
    Preview

    Available under License In Copyright.

    Download (686kB) | Preview
    Official URL: http://www.icfnds.org/

    Abstract

    In recent years, cyber attacks have caused substantial financial losses and been able to stop fundamental public services. Among the serious attacks, Advanced Persistent Threat (APT) has emerged as a big challenge to the cyber security hitting selected companies and organisations. The main objectives of APT are data exfiltration and intelligence appropriation. As part of the APT life cycle, an attacker creates a Point of Entry (PoE) to the target network. This is usually achieved by installing malware on the targeted machine to leave a back-door open for future access. A common technique employed to breach into the network, which involves the use of social engineering, is the spear phishing email. These phishing emails may contain disguised executable fi les. This paper presents the disguised executable le detection (DeFD) module, which aims at detecting disguised exe files transferred over the network connections. The detection is based on a comparison between the MIME type of the transferred fi le and the fi le name extension. This module was experimentally evaluated and the results show a successful detection of disguised executable files.

    Impact and Reach

    Statistics

    Activity Overview
    6 month trend
    717Downloads
    6 month trend
    482Hits

    Additional statistics for this dataset are available via IRStats2.

    Altmetric

    Repository staff only

    Edit record Edit record