Titans' revenge: Detecting Zeus via its own flaws

Marco Riccardi, Roberto Di Pietro, Marta Palanques, Jorge Aguilà Vila

Research output: Contribution to journalArticlepeer-review

20 Scopus citations


Malware is one of the main threats to the Internet security in general, and to commercial transactions in particular. However, given the high level of sophistication reached by malware (e.g. usage of encrypted payload and obfuscation techniques), malware detection tools and techniques still call for effective and efficient solutions. In this paper, we address a specific, dreadful, and widely diffused financial malware: Zeus. The contributions of this paper are manifold: first, we propose a technique to break the encrypted malware communications, extracting the keystream used to encrypt such communications; second, we provide a generalization of the proposed keystream extraction technique. Further, we propose Cronus, an IDS that specifically targets Zeus malware. The implementation of Cronus has been experimentally tested on a production network, and its high quality performance and effectiveness are discussed. Finally, we highlight some principles underlying malware - and Zeus in particular - that could pave the way for further investigation in this field. © 2012 Elsevier B.V. All rights reserved.
Original languageEnglish (US)
Pages (from-to)422-435
Number of pages14
JournalComputer Networks
Issue number2
StatePublished - Feb 4 2013
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2023-09-20

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Titans' revenge: Detecting Zeus via its own flaws'. Together they form a unique fingerprint.

Cite this