A clinical study of risk factors related to malware infections

Abstract

The success of malicious software (malware) depends upon both technical and human factors. The most security conscious users are vulnerable to zero-day exploits; the best security mechanisms can be circumvented by poor user choices. While there has been significant research addressing the technical aspects of malware attack and defense, there has been much less research reporting on how human behavior interacts with both malware and current malware defenses.In this paper we describe a proof-of-concept field study designed to examine the interactions between users, antivirus (anti-malware) software, and malware as they occur on deployed systems. The 4-month study, conducted in a fashion similar to the clinical trials used to evaluate medical interventions, involved 50 subjects whose laptops were instrumented to monitor possible infections and gather data on user behavior. Although the population size was limited, this initial study produced some intriguing, non-intuitive insights into the efficacy of current defenses, particularly with regards to the technical sophistication of end users. We assert that this work shows the feasibility and utility of testing security software through long-term field studies with greater ecological validity than can be achieved through other means.

An empirical study of global malware encounters

“…However, Mezzour et al do not examine malware types such as trojans, worms, and viruses. Finally, we find prior work that studies the correlation between users' demographics and attack encounters [22,9,24,33,38,44], but does not statistically explain international differences.…”

“…Moreover, several studies [22,9,24,33,38,44] examine the relationship between users' demographics and/or behavior, and malware exposure. That type of user-level analysis is important, but does not provide insight into how various country-level technical, social, economic, and policy factors affect countries' exposure to malware.…”

“…Understanding the effect of these country-level factors provides an opportunity for large scale reduction in the number of malware encounters. Some of these studies [22,24] do not examine the effect of country-level characteristics because of the limited international span of their user base. For example, the study by Levesque et al [22] uses data from 50 subjects in the Montreal area whose laptops were set up to gather data about malware infections and users' behavior.…”

“…Some of these studies [22,24] do not examine the effect of country-level characteristics because of the limited international span of their user base. For example, the study by Levesque et al [22] uses data from 50 subjects in the Montreal area whose laptops were set up to gather data about malware infections and users' behavior. Maier et al [24] use network traffic data of DSL users from an American university, an European urban area, and an Indian rural area.…”

Social Engineering Attacks on Government Opponents: Target Perspectives

“…Three additional operating systems had only an expired AV program (Expired AV), which was McAfee in each case. While advanced targeted threats may be engineered to evade antivirus software, these products can help protect against some more common threats [24].…”