WebCapsule: Towards a Lightweight Forensic Engine for Web Browsers
WebCapsule: Towards a Lightweight Forensic Engine for Web Browsers
复制标题
DOI：
10.1145/2810103.2813656
复制
发表时间：
2015-10
期刊：
影响因子：
--
通讯作者：
Christopher Neasbitt;Bo Li;R. Perdisci;Long Lu;Kapil Singh;Kang Li
中科院分区：
文献类型：
--
作者：
Christopher Neasbitt;Bo Li;R. Perdisci;Long Lu;Kapil Singh;Kang Li
对针对用户的真实网络安全事件（如社会工程和网络钓鱼攻击）进行详细的取证分析是一项非常具有挑战性和耗时的任务。为了重建基于Web的攻击，取证分析师通常依赖于浏览器缓存文件和系统日志。然而，缓存文件和日志只提供稀疏的信息，通常缺乏足够的细节来重建事件的精确视图。为了解决这个问题，我们需要一个始终在线的轻量级（即，低开销）取证数据收集系统，可以轻松地与各种流行的浏览器集成，并允许记录足够详细的信息，以便能够全面重建Web安全事件，包括网络钓鱼攻击。为此，我们提出了WebCapsule，一种新颖的记录和重放取证引擎的Web浏览器。WebCapsule作为一个始终在线的系统，旨在记录嵌入在流行浏览器中的核心Web渲染引擎的所有非确定性输入，包括与渲染的Web内容，Web流量以及从运行时环境接收的非确定性信号和事件的所有用户交互。与此同时，WebCapsule的目标是轻量级的，并引入低开销。此外，鉴于先前记录的跟踪，WebCapsule允许法医分析师在受控的隔离环境中完全重放和分析过去的Web浏览会话。我们设计的WebCapsule也是可移植的，因此它可以以最小的更改或不更改的方式集成到各种流行的Web渲染应用程序和平台中。为了实现这一目标，我们将WebCapsule构建为Google Blink渲染引擎及其紧密耦合的V8 JavaScript引擎的自包含仪表化版本。我们评估WebCapsule在许多现实世界的网络钓鱼攻击实例，并证明，这种攻击可以记录和完全重放。此外，我们表明，WebCapsule可以记录流行网站和不同平台上的复杂浏览会话（例如，Linux和Android），同时施加合理的开销，从而使始终在线记录变得实用。
Performing detailed forensic analysis of real-world web security incidents targeting users, such as social engineering and phishing attacks, is a notoriously challenging and time-consuming task. To reconstruct web-based attacks, forensic analysts typically rely on browser cache files and system logs. However, cache files and logs provide only sparse information often lacking adequate detail to reconstruct a precise view of the incident. To address this problem, we need an always-on and lightweight (i.e., low overhead) forensic data collection system that can be easily integrated with a variety of popular browsers, and that allows for recording enough detailed information to enable a full reconstruction of web security incidents, including phishing attacks. To this end, we propose WebCapsule, a novel record and replay forensic engine for web browsers. WebCapsule functions as an always-on system that aims to record all non-deterministic inputs to the core web rendering engine embedded in popular browsers, including all user interactions with the rendered web content, web traffic, and non-deterministic signals and events received from the runtime environment. At the same time, WebCapsule aims to be lightweight and introduce low overhead. In addition, given a previously recorded trace, WebCapsule allows a forensic analyst to fully replay and analyze past web browsing sessions in a controlled isolated environment. We design WebCapsule to also be portable, so that it can be integrated with minimal or no changes into a variety of popular web-rendering applications and platforms. To achieve this goal, we build WebCapsule as a self-contained instrumented version of Google's Blink rendering engine and its tightly coupled V8 JavaScript engine. We evaluate WebCapsule on numerous real-world phishing attack instances, and demonstrate that such attacks can be recorded and fully replayed. In addition, we show that WebCapsule can record complex browsing sessions on popular websites and different platforms (e.g., Linux and Android) while imposing reasonable overhead, thus making always-on recording practical.