Remote Harm-Diagnostics

We propose Remote Harm-Diagnostics (RHD) as a new defensive tactic against malware and phishing attacks. RHD is a server-side tool that harvests data from clients to detect signs of previous or ongoing compromise. RHD can supplement client-side protections such as virus checkers and anti-phishing toolbars. Given its “soft,” i.e., probabilistic nature, RHD interfaces naturally with risk-based authentication engines. We introduce RHD techniques that require no installation of client-side executables. These techniques permit servers to harvest selected Internet browsing history from visiting clients. We describe a lightweight, prototype RHD system that offers server-side detection of many forms of client compromise. Privacy-protection being a keystone of our approach, we introduce mechanisms for client-side filtering of data. We also briefly discuss audit and policy enhancements to help RHD systems comply with regulatory guidelines like the OECD Fair Information Practice Principles.