What's Your Major Threat? On the Differences between the Network Behavior of Targeted and Commodity Malware

Enrico Mariconti, Jeremiah Onaolapo, Gordon Ross, Gianluca Stringhini

Research output: Contribution to conferencePaperpeer-review

Abstract

This work uses statistical classification techniques to learn about the different network behavior patterns demonstrated by targeted malware and generic malware. Targeted malware is a recent type of threat, involving bespoke software that has been created to target a specific victim. It is considered a more dangerous threat than generic malware, because a targeted attack can cause more serious damage to the victim. Our work aims to automatically distinguish between the network activity generated by the two types of malware, which then allows samples of malware to be classified as being either targeted or generic. For a network administrator, such knowledge can be important because it assists to understand which threats require particular attention. Because a network administrator usually manages more than an alarm simultaneously, the aim of the work is particularly relevant. We set up a sandbox and infected virtual machines with malware, recording all resulting malware activity on the network. Using the network packets produced by the malware samples, we extract features to classify their behavior. Before performing classification, we carefully analyze the features and the dataset to study all their details and gain a deeper understanding of the malware under study. Our use of statistical classifiers is shown to give excellent results in some cases, where we achieved an accuracy of almost 96% in distinguishing between the two types of malware. We can conclude that the network behaviors of the two types of malicious code are very different.
Original languageEnglish
Number of pages10
DOIs
Publication statusPublished - Feb 2017
EventAvailability, Reliability and Security: 2016 11th International Conference - Salzburg, Austria
Duration: 31 Aug 20162 Sep 2016
http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?punumber=7777698

Conference

ConferenceAvailability, Reliability and Security
Abbreviated titleARES
CountryAustria
CitySalzburg
Period31/08/162/09/16
Internet address

Fingerprint

Dive into the research topics of 'What's Your Major Threat? On the Differences between the Network Behavior of Targeted and Commodity Malware'. Together they form a unique fingerprint.

Cite this