An Analysis of Malware Trends in Enterprise Networks

Abstract

We present an empirical and large-scale analysis of malware samples captured from two different enterprises from 2017 to early 2018. Particularly, we perform threat vector, social-engineering, vulnerability and time-series analysis on our dataset. Unlike existing malware studies, our analysis is specifically focused on the recent enterprise malware samples. First of all, based on our analysis on the combined datasets of two enterprises, our results confirm the general consensus that AV-only solutions are not enough for real-time defenses in enterprise settings because on average 40% of the malware samples, when first appeared, are not detected by most AVs on VirusTotal or not uploaded to VT at all (i.e., never seen in the wild yet). Moreover, our analysis also shows that enterprise users transfer documents more than executables and other types of files. Therefore, attackers embed malicious codes into documents to download and install the actual malicious payload instead of sending malicious payload directly or using vulnerability exploits. Moreover, we also found that financial matters (e.g., purchase orders and invoices) are still the most common subject seen in Business Email Compromise (BEC) scams that aim to trick employees. Finally, based on our analysis on the timestamps of captured malware samples, we found that 93% of the malware samples were delivered on weekdays. Our further analysis also showed that while the malware samples that require user interaction such as macro-based malware samples have been captured during the working hours of the employees, the massive malware attacks are triggered during the off-times of the employees to be able to silently spread over the networks.

Threat Actors’ Tenacity to Disrupt: Examination of Major Cybersecurity Incidents

“…In reference to the dataset in Figure 2 for example, malware attacks were primarily responsible for 48.0 percent of major cybersecurity incidents while phishing attacks accounts for 19.7 percent of them. The percent of major incidents caused by malware attacks as reported in this study is very likely to be the result of the computerization of many enterprises and the user interaction with these computer attacks [56], [57]. DoS/DDoS on the other hand, caused 13.5 percent of the major cybersecurity incidents identified in this study.…”

BejaGNN: Behavior-based Java Malware Detection via Graph Neural Network

“…In this paper, we focus on malware detection on the Java platform as the widespread application of Java in enterprise platforms and the rapidly increasing of malware in the wild [32]. Android applications, written in Java, have received much attention for their malicious detection [33].…”

Identifying Malicious DNS Tunnel Tools from DoH Traffic Using Hierarchical Machine Learning Classification

“…The existence of malware that uses DoH to communicate with C&C servers has been confirmed [11]. Many large-scale malware attacks have also been reported [18] and cyber-attacks will not stop on their own. Therefore, the fact that network traffic cannot be monitored because of encryption is a critical issue for network administrators.…”