The MALICIA dataset identification and analysis o

Authors: Antonio Nappa M Zubair Rafique Juan Caballero

Publish Date: 2014/06/21

Volume: 14, Issue: 1, Pages: 15-33

PDF Link

Abstract

Driveby downloads are the preferred distribution vector for many malware families In the driveby ecosystem many exploit servers run the same exploit kit and it is a challenge understanding whether the exploit server is part of a larger operation In this paper we propose a technique to identify exploit servers managed by the same organization We collect over time how exploit servers are configured which exploits they use and what malware they distribute grouping servers with similar configurations into operations Our operational analysis reveals that although individual exploit servers have a median lifetime of 16 h longlived operations exist that operate for several months To sustain longlived operations miscreants are turning to the cloud with 60  of the exploit servers hosted by specialized cloud hosting services We also observe operations that distribute multiple malware families and that payperinstall affiliate programs are managing exploit servers for their affiliates to convert traffic into installations Furthermore we analyze the exploit polymorphism problem measuring the repacking rate for different exploit types To understand how difficult is to takedown exploit servers we analyze the abuse reporting process and issue abuse reports for 19 longlived servers We describe the interaction with ISPs and hosting providers and monitor the result of the report We find that 61  of the reports are not even acknowledged On average an exploit server still lives for 43 days after a report Finally we detail the Malicia dataset we have collected and are making available to other researchersThe authors would like to thank Chris Grier and Kurt Thomas for their help and the anonymous reviewers for their insightful comments This work was supported in part by the European Union through the FP7 network of excellence NESSoS Grant FP7ICT No 256980 by the Spanish Government through the StrongSoft project Grant TIN201239391C0401 and a Juan de la Cierva Fellowship for Juan Caballero by the NGreens CM project by the Research Fund KU Leuven and by the Fight against Crime Programme of the European Union BCCENTRE Opinions expressed in this material are those of the authors and do not necessarily reflect the views of the sponsors

Keywords: