Certified PUP

Kotzias, Platon; Matic, Srdjan; Rivera, Richard; Caballero, Juan

doi:10.1145/2810103.2813665

Cited by 33 publications

(8 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The work of Ife et al [4] also covers comprehensive data, including malware binaries and URLs, but we point out that the dataset used in this work is rather dated (2016). We also differ our work from other works [3]- [5] that leveraged the AV vendor dataset which only consists of metadata, not the real binaries. We emphasize that our work shows the current state of malware distribution and attempts to maintain representativeness by crawling realtime data.…”

Section: Related Workmentioning

confidence: 88%

“…Some existing works focused on understanding specific phenomenons. For instance, existing works have sought to understand Potentially Unwanted Programs (PUPs) in depth [2], [3]. Some works focused on the behavior and characteristics of malware binaries themselves [7], [24], and a few works are even more focused, only considering Windows executables [5], [6], or distribution URLs [9].…”

Section: Related Workmentioning

confidence: 99%

“…Rather, we consider all malware types that users frequently encounter through using public data sources. This differs our work from previous works that have only considered the malware binaries of certain behavior [7], [24], or a specific subset of malware binaries [1]- [3], [5]. Our work, on the other hand, captures a more comprehensive view on the state of malware distribution and adversary strategies.…”

Section: Introductionmentioning

confidence: 96%

“…Thomas et al [2] focused on the Potentially Unwanted Program (PUP) distributed by PPI services. Furthermore, Kotzias et al [3] and Ife et al [4] conducted a large-scale analysis on identifying the distribution patterns of PUPs with the metadata collection provided by AV vendors. Kwon et al [5] presented a large-scale analysis on Windows executables droppers, which is conducted with the metadata collection provided by an AV vendor.…”

Section: Introductionmentioning

confidence: 99%

“…Second, we analyze both malware distribution sites and the binaries collected from the URLs. There are also existing works [3], [4] that have also conducted analysis on both malware binaries and URLs, but we point out that their dataset is rather dated, which is collected no later than 2016. By analyzing both binaries and their distribution sites, we take a closer look into the current adversary strategies from malware binary generation to their distribution.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Comprehensive Analysis of Today’s Malware and Its Distribution Network: Common Adversary Strategies and Implications

et al. 2022

View full text Add to dashboard Cite

Malware has plagued the internet and computing systems for decades. The war against malware has always been an arms race. Researchers and industry have constantly improved detection and prevention methodologies against increasingly more evasive malware. Keeping up with the constantly changing adversary tactics for evading defensive efforts and maintaining an efficient malware supply chain is imperative to stay ahead in the competition. In this paper, we present a large-scale and comprehensive analysis of the current state of malware distribution. For the analysis, we accumulated a dataset that contains 99,312 malware binary samples from 38,659 malware distribution sites over 287 days. Using our dataset, we perform a comprehensive analysis of the collected malware binaries and URLs to provide up-to-date statistics and insights into the adversary strategies. We analyze both malware distribution sites and malware binaries collected from them. Regarding binary analysis, we perform a multifaceted analysis on the characteristics on the collected binaries, including malware family label classification and file similaritybased clustering. With distribution site analysis, we analyze the IP addresses, domains, AS registration distribution and URL lexical distribution of malware distribution sites. We further discuss the statistical relationship between malware families and their distribution domains. Most importantly, we discuss the current trends in malware distribution today and reveal adversary strategies through our extensive amount of analysis results. Then, we suggest future directions for fight against malware distribution.

show abstract

Section: Related Workmentioning

confidence: 88%