Hfinger: Malware HTTP Request Fingerprinting.

Area of Science:

• Cybersecurity
• Network Security
• Malware Analysis

Background:

• Malicious software uses HTTP for communication, blending with normal traffic.
• Existing fingerprinting tools inadequately analyze HTTP request components.
• Difficulty in identifying and tracking malware-generated HTTP traffic.

Purpose of the Study:

• Introduce Hfinger, a novel tool for malware HTTP request fingerprinting.
• Enhance the accuracy and distinctiveness of malware traffic identification.
• Improve malware tracking and hunting by providing more unique fingerprints.

Main Methods:

• Extracting information from URI, protocol, headers, and payload of HTTP requests.
• Developing a concise request representation interpretable by human analysts.
• Experimental evaluation using real-world datasets and comparison with FATT, Mercury, and p0f.

Main Results:

• Hfinger achieves an average collision rate of 1.85% between malware families, 8-34 times lower than existing tools.
• Hfinger avoids collisions between malware and benign applications in default mode.
• Fingerprint count increases by at most 3 times while maintaining distinctiveness.

Conclusions:

• Hfinger offers superior malware HTTP request fingerprinting compared to existing tools.
• The tool effectively distinguishes malware traffic from benign applications.
• Hfinger provides a valuable solution for enhanced malware tracking and threat hunting.