HTTP header heuristics for malware detection

Sophisticated malware, such as those used by Advanced Persistent Threat (APT) groups, will attempt to avoid detection wherever and whenever it can. However, even the stealthiest malware will have to communicate at some point, and when it does so, it provides an opportunity for detection. This paper looks at a number of techniques to identify the presence of malware which attempts to masquerade as legitimate web browsing activity, exploiting some of the occasionally inaccurate attempts to mimic the HTTP protocol. This should provide network defenders with greater opportunity to detect malicious activity, without the need for maintaining a corpus of virus specific signatures that are vulnerable to change.