An Epidemiological Study of Malware Encounters in a Large Enterprise

Abstract

We present an epidemiological study of malware encounters in a large, multi-national enterprise. Our data sets allow us to observe or infer not only malware presence on enterprise computers, but also malware entry points, network locations of the computers (i.e., inside the enterprise network or outside) when the malware were encountered, and for some web-based malware encounters, web activities that gave rise to them. By coupling this data with demographic information for each host's primary user, such as his or her job title and level in the management hierarchy, we are able to paint a reasonably comprehensive picture of malware encounters for this enterprise. We use this analysis to build a logistic regression model for inferring the risk of hosts encountering malware; those ranked highly by our model have a > 3× higher rate of encountering malware than the base rate. We also discuss where our study confirms or refutes other studies and guidance that our results suggest.

An empirical study of global malware encounters

“…However, Mezzour et al do not examine malware types such as trojans, worms, and viruses. Finally, we find prior work that studies the correlation between users' demographics and attack encounters [22,9,24,33,38,44], but does not statistically explain international differences.…”

“…Moreover, several studies [22,9,24,33,38,44] examine the relationship between users' demographics and/or behavior, and malware exposure. That type of user-level analysis is important, but does not provide insight into how various country-level technical, social, economic, and policy factors affect countries' exposure to malware.…”

“…Many studies notice international differences in malware encounters [44,26,27,8,9], but mostly hypothesize about reasons behind such differences without empirically testing the validity of such hypotheses. For example, Caballero et al [8] hypothesize that fake anti-viruses are most prevalent in Western European and North American countries because attackers are interested in taking advantage of the large computing and monetary resources in these countries.…”

Endpoint Security in Networks: An OpenMP Approach for Increasing Malware Detection Speed

“…In addition, some types of malware can take remote control of computers to increase the damage caused by the attacker. It has been seen in the literature that the amount of malware targeting Windows OS (Microsoft Corporation, Redmond, WA, USA) is larger than targeting other OS [1,2].…”

“…Server based antiviruses are not supposed to detect malware inserted either via removable media (USB flash drives and external hard drives) or through wireless access not controlled by network administrators before it reaches the target system. Furthermore, there is not a known antivirus that can detect an encrypted virus in files, and this approach has been used lately by attackers [1,2,6].…”