An Analysis of Gameover Zeus Network Traffic

Malware is evolving to use encryption techniques to obfuscate network communication to evade detection. This paper analyzes anomalies within network traffic generated by Gameover Zeus. The anomalies result from the encryption methods used to obfuscate network communications. However, even though the anomalies can be seen when manually inspecting the network packets, the obfuscation techniques pose difficulties when attempting to use signature based Intrusion Detection Systems (IDS) for detection. While the anomalies may not be useful for constructing IDS signatures, they may be useful in constructing custom detection algorithms.