A discovery of sequential attack patterns of malware in botnets

Rosyid, Nur Rohman; Ohrui, Masayuki; Kikuchi, Hiroaki; Sooraksa, Pitikhate; Terada, Masato

doi:10.1109/icsmc.2010.5641914

Cited by 10 publications

(7 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The dataset has already been studied and analyzed as follows. Roysid et al [5] brought up the ideas to detect se quential attack patterns using the PrefixSpan method for malware identification based on 2009 CCC dataset. Later on, the correlation analysis between 10 spamming botnets is presented and based on analysis of 3 weeks of spam email in their Darknets and Honeypots (2010 CCC Dataset) by [6].…”

Section: Reference [4] Explains the Purpose Of Cyber Clean Centermentioning

confidence: 99%

Temporal behaviors of Top-10 malware download in 2010–2012

Yukonhiatou

Kittitornkun

Kikuchi

et al. 2014

2014 International Electrical Engineering Congress (iEECON)

Self Cite

View full text Add to dashboard Cite

Malware can be widely downloaded over tbe Internet by the bot-infected computers according to their botmaster in order to form a botnet and eventually to perform cyber attacks. This paper analyzes and summarizes the mal ware download behaviors of To p-10 malware based on 2010 CCC, 2011 CCC and 2012 I1J MITF datasets. The datasets contain millions of download logs collected from several Honeypots located in Japan observing malwarelbot traffic and activities. These log data have been processed and analyzed in terms of daily and hourly downloads based on our To p-10 processing algorithm. As a result, both daily and hourly download patterns in each year are quite different due to different malware families and spreading protocols.

show abstract

Section: Reference [4] Explains the Purpose Of Cyber Clean Centermentioning

confidence: 99%

Temporal behaviors of Top-10 malware download in 2010–2012

Yukonhiatou

Kittitornkun

Kikuchi

et al. 2014

2014 International Electrical Engineering Congress (iEECON)

Self Cite

View full text Add to dashboard Cite

show abstract

“…Both aforementioned works demonstrate that, some anti-virus software can significantly improve detection rates with training on older malware. The research conducted by Rosyid et al [11] is focused on detecting malicious attack patterns in botnets attacking a honeypot during the year 2009. After extracting the log files of malware sequences, they then apply the PrefixSpan algorithm to discover subsequence patterns.…”

Section: Related Workmentioning

confidence: 99%

Exploring Timeline-Based Malware Classification

Islam

Altas

Islam

2013

Security and Privacy Protection in Information Processing Systems

View full text Add to dashboard Cite

Over the decades or so, Anti-Malware (AM) communities have been faced with a substantial increase in malware activity, including the development of ever-more-sophisticated methods of evading detection. Researchers have argued that an AM strategy which is successful in a given time period cannot work at a much later date due to the changes in malware design. Despite this argument, in this paper, we convincingly demonstrate a malware detection approach, which retains high accuracy over an extended time period. To the best of our knowledge, this work is the first to examine malware executables collected over a span of 10 years. By combining both static and dynamic features of malware and cleanware, and accumulating these features over intervals in the 10-year period in our test, we construct a high accuracy malware detection method which retains almost steady accuracy over the period. While the trend is a slight down, our results strongly support the hypothesis that perhaps it is possible to develop a malware detection strategy that can work well enough into the future.

show abstract

“…The research conducted by Rosyid et al [11] is focused on detecting malicious attack patterns in botnets. They use a set of sequential attacks which was recorded by a honeypot during the year 2009.…”

Section: Related Workmentioning

confidence: 99%

A Comparison of the Classification of Disparate Malware Collected in Different Time Periods

Islam¹,

Tian²,

Moonsamy

et al. 2012

JNW

View full text Add to dashboard Cite

It has been argued that an anti-virus strategy based on malware collected at a certain date, will not work at a later date because malware evolves rapidly and an anti-virus engine is then faced with a completely new type of executable not as amenable to detection as the first was.

In this paper, we test this idea by collecting two sets of malware, the first from 2002 to 2007, the second from 2009 to 2010 to determine how well the anti-virus strategy we developed based on the earlier set [18] will do on the later set. This anti-virus strategy integrates dynamic and static features extracted from the executables to classify malware by distinguishing between families. We also perform another test, to investigate the same idea whereby we accumulate all the malware executables in the old and new dataset, separately, and apply a malware versus cleanware classification.

The resulting classification accuracies are very close for both datasets, with a difference of approximately 5.4% for both experiments, the older malware being more accurately classified than the newer malware. This leads us to conjecture that current anti-virus strategies can indeed be modified to deal effectively with new malware.

show abstract

A discovery of sequential attack patterns of malware in botnets

Cited by 10 publications

References 2 publications

Temporal behaviors of Top-10 malware download in 2010–2012

Temporal behaviors of Top-10 malware download in 2010–2012

Exploring Timeline-Based Malware Classification

A Comparison of the Classification of Disparate Malware Collected in Different Time Periods

Contact Info

Product

Resources

About

A discovery of sequential attack patterns of malware in botnets

Cited by 10 publications

References 2 publications

Temporal behaviors of Top-10 malware download in 2010&#x2013;2012

Temporal behaviors of Top-10 malware download in 2010&#x2013;2012

Exploring Timeline-Based Malware Classification

A Comparison of the Classification of Disparate Malware Collected in Different Time Periods

Contact Info

Product

Resources

About

Temporal behaviors of Top-10 malware download in 2010–2012

Temporal behaviors of Top-10 malware download in 2010–2012