Malware Distribution Research Articles

Routine activity theory and malware, fraud, and spam at the national level

Email spam is one of the primary means to facilitate the perpetration of internet fraud and the distribution of malware. The present research sought to examine the impact of routine activity theory at the national level on three forms of cybercrime perpetrated through email spam. A sample of 871,146 spam email messages sent in 2012 were divided into three categories: fraudulent emails, emails spreading malware, and non-serious spam emails. The measures were then aggregated by country and five measures of routine activity theory at the national level were tested for their impact on cybercrime among 120 nations. Concurrent with prior research, the results indicated that internet users per capita positively predicted all three forms of cybercrime. Unlike previous research, GDP presented a different relationship amongst all three outcomes: positive for spam, negative for fraud, and nonsignificant for malware. Implications of these findings and suggestions for future research are discussed.

Fast Packet Inspection for End-To-End Encryption

With the recent development and popularization of various network technologies, communicating with people at any time, and from any location, using high-speed internet, has become easily accessible. At the same time, eavesdropping, data interception, personal data leakage, and distribution of malware during the information transfer process have become easier than ever. Recently, to respond to such threats, end-to-end encryption (E2EE) technology has been widely implemented in commercial network services as a popular information security system. However, with the use of E2EE technology, it is difficult to check whether an encrypted packet is malicious in an information security system. A number of studies have been previously conducted on deep packet inspection (DPI) through trustable information security systems. However, the E2EE is not maintained when conducting a DPI, which requires a long inspection time. Thus, in this study, a fast packet inspection (FPI) and its frame structure for quickly detecting known malware patterns while maintaining E2EE are proposed. Based on the simulation results, the proposed FPI allows for inspecting packets approximately 14.4 and 5.3 times faster, respectively, when the inspection coverage is 20% and 100%, as compared with a DPI method under a simulation environment in which the payload length is set to 640 bytes.

DeMSF: a Method for Detecting Malicious Server Flocks for Same Campaign

Nowadays, cybercriminals tend to leverage dynamic malicious infrastructures with multiple servers to conduct attacks, such as malware distribution and control. Compared with a single server, employing multiple servers allows crimes to be more efficient and stealthy. As the necessary role infrastructures play, many approaches have been proposed to detect malicious servers. However, many existing methods typically target only on the individual server and therefore fail to reveal inter-server connections of an attack campaign.In this paper, we propose a complementary system, deMSF, to identify server flocks, which are formed by infrastructures involved in the same malicious campaign. Our solution first acquires server flocks by mining relations of servers from both spatial and temporal dimensions. Further we extract the semantic vectors of servers based on word2vec and build a textCNN-based flocks classifier to recognize malicious flocks. We evaluate deMSF with real-world traffic collected from an ISP network. The result shows that it has a high precision of 99% with 90% recall.

Detecting Malicious Applications on Android is based on Static Analysis using Machine Learning Algorithm

Attacks on users through mobile devices in general, and mobile devices with Android operating system in particular, have been causing many serious consequences. Research [1] lists the vulnerabilities found in the Android operating system, making it the preferred target of cyberattackers. Report [2] statistics the number of cyberattacks via mobile devices and mobile devices using Android operating system. The report points out the insecurity of information from applications downloaded by users from Android apps stores. Therefore, to prevent the attack and distribution of malware through Android apps, it is necessary to research the method of detecting malicious code from the time users download applications to their devices. Recent approaches often rely on static analysis and dynamic analysis to look for unusual behavior in applications. In this paper, we will propose the use of static analysis techniques to build a behavior of malicious code in the application and machine learning algorithms to detect malicious behavior.

Dynamic Expert System-Based Geographically Adapted Malware Risk Evaluation Method

Fast development of information systems and technologies while providing new opportunities for people and organizations also make them more vulnerable at the same time. Information security risk assessment helps to identify weak points and preparing mitigation actions. The analysis of expert systems has shown that rule-based expert systems are universal, and because of that can be considered as a proper solution for the task of risk assessment automation. But to assess information security risks quickly and accurately, it is necessary to process a large amount of data about newly discovered vulnerabilities or threats, to reflect regional and industry specific information, making the traditional approach of knowledge base formation for expert system problematic. This work presents a novel method for an automated expert systems knowledge base formation based on the integration of data on regional malware distribution from Cyberthreat real-time map providing current information on newly discovered threats. In our work we collect the necessary information from the web sites in an automated way, that can be later used in a relevant risk calculation. This paper presents method implementation, which includes not only knowledge base formation but also the development of the prototype of an expert system. It was created using the JESS expert system shell. Information security risk evaluation was performed according to OWASP risk assessment methodology, taking into account the location of the organization and prevalent malware in that area.

Anatomy on Malware Distribution Networks

Malware distribution networks are a huge network that involves in malware distribution. We do not much realize the seriousness of the network in daily life. Until now, the works to analyze the network have been studied, but they are still limited because many researchers focused on detection, not investigating the internal structures of malware distribution networks. In this circumstance, the recent works tried to analyze the malware distribution networks in terms of social network analysis based on graph theories. They analyzed the malware distribution networks with nodes used in malware distribution such as malicious URLs, FQDN, malware and IPs, generated during drive-by downloads, or appeared outbound contacts. However, this approach is still lack in understandings malware distribution networks. In this study, we realized that degree (or closeness, betweenness, or eigenvector) centrality measures are beneficial in finding central nodes engaging in malware distribution. This central information is by far valuable in understanding the properties of malicious network infrastructure. For instance, from degree centrality measures, we realized that malware distribution networks show high in-degree, while benign networks present high out-degree. This result offers artifacts that classify malicious networks from benign networks. After all, this study provides fundamental information to help distinguish heterogeneous networks useful in future research.

Digital Waste Disposal: an automated framework for analysis of spam emails

Spam email automated analysis and classification are a challenging task, which is vital in the identification of botnet structures and cybercrime fighting. In this work, we propose an automated methodology and the resulting framework based on innovative categorical divisive clustering, used both for grouping and for classification of spam messages. In particular, the grouping is exploited to identify campaigns of similar spam emails, while the classification is used to label specific emails according to the goal of spammer (e.g., phishing, malware distribution, advertisement, etc.). This work introduces the CCTree algorithm, both as clustering algorithm and as classification algorithm, in two operative modes: batch and dynamic, to handle both large data sets and data streams. Afterward, the CCTree is applied to large sets of spam emails for campaign identification and labeling. The performance of the algorithm is reported for both clustering and classification, and a comparison between the batch and dynamic approaches is presented and discussed.

A cost analysis of machine learning using dynamic runtime opcodes for malware detection

The ongoing battle between malware distributors and those seeking to prevent the onslaught of malicious code has, so far, favored the former. Anti-virus methods are faltering with the rapid evolution and distribution of new malware, with obfuscation and detection evasion techniques exacerbating the issue. Recent research has monitored low-level opcodes to detect malware. Such dynamic analysis reveals the code at runtime, allowing the true behaviour to be examined. While previous research uses machine learning techniques to accurately detect malware using dynamic runtime opcodes, underpinning datasets have been poorly sampled and inadequate in size. Further, the datasets are always fixed size and no attempt, to our knowledge, has been made to examine the cost of retraining malware classification models on datasets which grow continually. In the literature, researchers discuss the explosion of malware, yet opcode analyses have used fixed-size datasets, with no deference to how this model will cope with retraining on escalating datasets. The research presented here examines this problem, and makes several novel contributions to the current body of knowledge.First, the performance of 23 machine learning algorithms are investigated with respect to the largest run trace dataset in the literature. Second, following an extensive hyperparameter selection process, the performance of each classifier is compared, on both accuracy and computational costs (CPU time). Lastly, the cost of retraining and testing updatable and non-updatable classifiers, both parallelized and non-parallelized, is examined with simulated escalating datasets. This provides insight into how implemented malware classifiers would perform, given simulated dataset escalation. We find that parallelized RandomForest, using 4 cores, provides the optimal performance, with high accuracy and low training and testing times.

Empirical analysis of weapons of influence, life domains, and demographic-targeting in modern spam: an age-comparative perspective

Spam has been increasingly used for malware distribution. This paper analyzed modern spam from an age-comparative perspective to (i) discover the extent to which psychological weapons of influence and life domains were represented in today’s spam emails and (ii) clarify variations in the use of these weapons and life domains by user demographics. Thirty five young and 32 older participants forwarded 18,605 emails from their spam folder to our study email account. A random set of 961 emails were submitted to qualitative content coding and quantitative statistical analysis. Reciprocation was the most prevalent weapon; financial, leisure, and independence the most prevalent life domains. Older adults received health and independence-related spam emails more frequently, while young adults received leisure and occupation-related spam emails more often. These age differences show a level of targeting by user demographics in current spam campaigns. This targeting shows the need for age-tailored demographic warnings highlighting the presence of influence and pretexting (life domains) for suspicious emails for improved response to cyber-attacks that could result from spam distribution. The insights from this study and the produced labeled dataset of spam messages can inform the development of the next generation of such solutions, especially those based on machine learning.

Automated Link Tracing for Classification of Malicious Websites in Malware Distribution Networks

Malicious code distribution on the Internet is one of the most critical Internet-based threats and distribution technology has evolved to bypass detection systems. As a new defense against the detection bypass technology of malicious attackers, this study proposes the automated tracing of malicious websites in a malware distribution network (MDN). The proposed technology extracts automated links and classifies websites into malicious and normal websites based on link structure. Even if attackers use a new distribution technology, website classification is possible as long as the connections are established through automated links. The use of a real web-browser and proxy server enables an adequate response to attackers’ perception of analysis environments and evasion technology and prevents analysis environments from being infected by malicious code. The validity and accuracy of the proposed method for classification are verified using 20,000 links, 10,000 each from normal and malicious websites.

Potential Risk Analysis Method for Malware Distribution Networks

In this study, the structural characteristics of malware distribution networks (MDNs) were examined and the network centrality of the relationships between websites containing malware, infection sites, intermediate connection sites, and initial connection sites were analyzed. The core malware sites within MDNs that contribute to the success of cyberattacks were identified, and the overall risk of the MDNs, which changes dynamically, was examined quantitatively to predict additional attacks. As such, real-time security events occurring in the information security systems of target organizations were collected and analyzed, and different types of security intelligence were assessed to recreate various MDNs. In addition, the risk levels of malicious URLs, IPs, etc. in MDNs were analyzed continuously over time, and a model suitable for predicting potential attack times was developed. The developed model identified the characteristics of potential future cyberattacks based on the analyzed initial MDN risk level, as well as the connectivity of and malware associated with the MDN, which change over time, thereby maintaining an average prediction accuracy of 94.9% over one week.

Sec-Lib: Protecting Scholarly Digital Libraries From Infected Papers Using Active Machine Learning Framework

Researchers from academia and the corporate-sector rely on scholarly digital libraries to access articles. Attackers take advantage of innocent users who consider the articles' files safe and thus open PDF-files with little concern. In addition, researchers consider scholarly libraries a reliable, trusted, and untainted corpus of papers. For these reasons, scholarly digital libraries are an attractive-target and inadvertently support the proliferation of cyber-attacks launched via malicious PDF-files. In this study, we present related vulnerabilities and malware distribution approaches that exploit the vulnerabilities of scholarly digital libraries. We evaluated over two-million scholarly papers in the CiteSeerX library and found the library to be contaminated with a surprisingly large number (0.3-2%) of malicious PDF documents (over 55% were crawled from the IPs of US-universities). We developed a two layered detection framework aimed at enhancing the detection of malicious PDF documents, Sec-Lib, which offers a security solution for large digital libraries. Sec-Lib includes a deterministic layer for detecting known malware, and a machine learning based layer for detecting unknown malware. Our evaluation showed that scholarly digital libraries can detect 96.9% of malware with Sec-Lib, while minimizing the number of PDF-files requiring labeling, and thus reducing the manual inspection efforts of security-experts by 98%.

СЕТЕВЫЕ МОДЕЛИ ПРОЦЕССОВ РАСПРОСТРАНЕНИЯ ВРЕДОНОСНЫХ ПРОГРАММ

The paper deals with the analysis of possible ways of spreading malware on the basis of weighted graphs, where the graph describes the relationship between different programs, and the weight shows the probability of transition malware from one software system to another. The task is to identify the most likely routes of malicious programs distribution and to find the most likely ways of their penetration into a given software product. The method of dynamic programming is proposed to solve the problem. The procedure of solving the problem has been demonstrated on a particular example. The results of calculations helped to determine the most probable route of penetration and to estimate the probability of successful attack of malicious programs on the required software product. Graph theory methods also allowed to estimate a number of other numerical characteristics related to the process of the malicious programs distribution, which include the minimum number of clock cycles of the system (after the implementation of this characteristic it becomes possible for a malicious program to penetrate the specified software product); the number of clock cycles of the system (when probability of penetration of the malware into a specific file will be greater than the specified value). Besides, the method helps identify cyclical routes of malware distribution, which characterizes repeated attempts of malware to impact on the software product, find the most likely sources of distribution, detect the files, through which penetration into given software product is possible.

Malware propagation in smart grid monocultures

Smart power grids require a communication infrastructure to collect sensor data and to send control commands. The common trend for cost reduction influences the architecture, implementation, networking, and operation of smart grid devices. Whereas hardware and software reuse are imperative for vendors to lower device costs, utility companies substantially decrease their operational costs by deploying a homogeneous device base. Thousands of smart meters that feature identical hardware, firmware, and software, are one main prerequisite for automated maintenance, support, and device replacement. However, these cost savings create optimum conditions for malware propagation and infection in the grids’ control networks.In this paper we show how monocultures in device types can lead to critical situations if malware exploits a common vulnerability. Although we assume that classical defensive measures, e.g., firewalls, virtual networks, and intrusion detection, are in place, we argue that new or unpatched vulnerabilities cannot be ruled out and may lead to a very fast distribution of malware in large parts of the smart grids’ control network. Besides showing how fast malware can spread in device monocultures, we also discuss effective defensive measures that can support utility companies in preventing or containing malware distribution.

Empirical study of malware diversity in major Android markets

ABSTRACTThe popularity of Android has motivated a significant increase in the amount of malware specially designed to target this operating system. During the last years, the threat has become more serious and every day cybercriminals create and share new specimens through almost all existing markets. This situation has promoted a notable research interest in the development of automated malware detection and classification systems. In this paper, we perform a large-scale empirical study to examine the diversity of Android malware in major markets. Through the analysis of more than 5 million of apps, we use the labels assigned by 57 different anti-malware vendors and diversity measures to get insights about the distribution and evolution of Android malware. Furthermore, we propose a dissimilarity measure for comparing these labels, which can be applied as part of an agglomerative hierarchical clustering algorithm. This clustering method groups the labels according to the scanning reports of different anti-malware vendors. The results obtained make evident an increase in the diversification of malware in both official and alternative markets. Moreover, we show how the criteria of various anti-malware, in conjunction with clustering techniques, is a suitable approach for grouping and analysing malware samples that perform a similar behaviour.

Automated analysis of freeware installers promoted by download portals

We present an analysis system for studying Windows application installers. The analysis system is fully automated from installer download to execution and data collection. The system emulates the behavior of a lazy user who wants to finish the installation dialogs with the default options and with as few clicks as possible. The UI automation makes use of image recognition techniques and heuristics. During the installation, the system collects data about the system modification and network access. The analysis system is scalable and can run on bare-metal hosts as well as in a data center. We use the system to analyze 792 freeware application installers obtained from popular download portals. In particular, we measure how many of them drop potentially unwanted programs (PUP) such as browser plugins or make other unwanted system modifications. We discover that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks. We also find, that while popular download portals are not used for blatant malware distribution, nearly 10% of the analyzed installers come with a third-party browser or a browser extension.

Reprint of “You can’t touch this: Consumer-centric android application repackaging detection”

Application repackaging is a widely used method for malware distribution, revenue stealing and piracy. Repackaged applications are modified versions of original applications, that can potentially target large audiences based on the original application’s popularity. In this paper, we propose an approach for detecting repackaged applications. Our approach takes advantage of the attacker’s reluctance to significantly alter the elements that characterise an application without notably impacting the application’s distribution. These elements include the application’s name and icon. The detection is initiated from the client side, prior to an application’s installation, making it application store agnostic. Our experimental results show that detection based on our algorithm is effective and efficient.

A methodology for the security evaluation within third-party Android Marketplaces

This paper aims to evaluate possible threats with unofficial Android marketplaces, and geo-localize the malware distribution over three main regions: China; Europe; and Russia. It provides a comprehensive review of existing academic literature about security in Android focusing especially on malware detection systems and existing malware databases. Through the implementation of a methodology for identification of malicious applications it has been collected data revealing a 5% of them as malicious in an overall analysis. Furthermore, the analysis shown that Russia and Europe have a preponderance of generic detections and adware, while China is found to be targeted mainly by riskware and malware.

Analysis of malware download sites by focusing on time series variation of malware

As the use of Internet increases, malicious activity has become increasingly problematic. In particular, drive-by download attacks have become a serious problem. As part of an exploit-as-a-service ecosystem for drive-by download attacks, malware download sites play a particularly important role. In this study, we analyzed approximately 43,000 malware download URLs to investigate malware distribution and the behavior of malware download sites over an extended period, i.e., over 1.5 years. We found that some sites survive for a very long time and are revived frequently, a finding not revealed in previous research. By focusing on the malware variation, we have identified three categories of malware download sites, i.e., unchanged, every time changed, changed occasionally. We found that 10% of unchanged sites survived for more than 500 days, and 10% of changed occasionally sites were revived more than 15 times in the entire observation period. We also analyzed sites in terms of IP address changes, anti-virus application results, URL features, and VirusTotal results. We found that each category had different attacker operational and resource characteristics. Finally, based on our findings, we discuss effective countermeasures for each category.

Analyzing the ecosystem of malicious URL redirection through longitudinal observation from honeypots

Today, websites are exposed to various threats that exploit their vulnerabilities. A compromised website will be used as a stepping-stone and will serve attackers' evil purposes. For instance, URL redirection mechanisms have been widely used as a means to perform web-based attacks covertly; i.e., an attacker injects a redirect code into a compromised website so that a victim who visits the site will be automatically navigated to a malware distribution site. Although many defense operations against malicious websites have been developed, we still encounter many active malicious websites today. As we will show in the paper, we infer that the reason is associated with the evolution of the ecosystem of malicious redirection.Given this background, we aim to understand the evolution of the ecosystem through long-term measurement. To this end, we developed a honeypot-based monitoring system, which specializes in monitoring the behavior of URL redirections. We deployed the monitoring system across four years and collected more than 100K malicious redirect URLs, which were extracted from 776 distinct websites. Our chief findings can be summarized as follows: (1) Click-fraud has become another motivation for attackers to employ URL redirection, (2) The use of web-based domain generation algorithms (DGAs) has become popular as a means to increase the entropy of redirect URLs to thwart URL blacklisting, and (3) Both domain-flux and IP-flux are concurrently used for deploying the intermediate sites of redirect chains to ensure robustness of redirection.Based on the results, we also present practical countermeasures against malicious URL redirections. Security/network operators can leverage useful information obtained from the honeypot-based monitoring system. For instance, they can disrupt infrastructures of web-based attack by taking down domain names extracted from the monitoring system. They can also collect web advertising/tracking IDs, which can be used to identify the criminals behind attacks.