000000257 001__ 257
000000257 005__ 20130522141941.0
000000257 037__ $$aLERSSE-RefConfPaper-2011-003
000000257 100__ $$aKyle Zeeuwen
000000257 245__ $$aImproving Malicious URL Re-Evaluation Scheduling Through an Empirical Study of Malware Download Centers
000000257 260__ $$c2011-03-28
000000257 300__ $$a8
000000257 520__ $$aThe retrieval and analysis of malicious content is an essential task for security researchers. At the same time, the distrib- utors of malicious files deploy countermeasures to evade the scrutiny of security researchers. This paper investigates two techniques used by malware download centers: frequently updating the malicious payload, and blacklisting (i.e., re- fusing HTTP requests from researchers based on their IP). To this end, we sent HTTP requests to malware download centers over a period of four months. The requests are dis- tributed across two pools of IPs, one exhibiting high volume research behaviour and another exhibiting semi-random, low volume behaviour. We identify several distinct update pat- terns, including sites that do not update the binary at all, sites that update the binary for each new client but then repeatedly serve a specific binary to the same client, sites that periodically update the binary with periods ranging from one hour to 84 days, and server-side polymorphic sites, that deliver new binaries for each HTTP request. From this classification we identify several guidelines for crawlers that re-query malware download centers looking for binary updates. We propose a scheduling algorithm that incorpo- rates these guidelines, and perform a limited evaluation of the algorithm using the data we collected. We analyze our data for evidence of blacklisting and find strong evidence that a small minority of URLs blacklisted our high volume IPs, but for the majority of malicious URLs studied, there was no observable blacklisting response, despite issuing over over 1.5 million requests to 5001 different malware download centers.
000000257 6531_ $$aTachyon
000000257 6531_ $$aMalicious URL crawling
000000257 6531_ $$aMalware Download Centers
000000257 6531_ $$aServer Side Polymorphism
000000257 6531_ $$aLow Interaction Honeyclient
000000257 6531_ $$aSample Collection
000000257 6531_ $$aIP Blacklisting
000000257 700__ $$aMatei Ripeanu
000000257 700__ $$aKonstantin Beznosov
000000257 8560_ $$fkylez@ece.ubc.ca
000000257 8564_ $$uhttp://lersse-dl.ece.ubc.ca/record/257/files/257.pdf$$yTransfer from CDS 0.99.7
000000257 909C4 $$pK. Zeeuwen, M. Ripeanu, K. Beznosov, “Improving Malicious URL Re-Evaluation Scheduling Through an Empirical Study of Malware Download Centers”. WebQuality Workshop 2011, March 28, 2011.
000000257 980__ $$aRefConfPaper