Analysis of Malicious Files Gathering via Honeypot Trap System and Benchmark of Anti-Virus Software

Abstract

In an era dominated by the pervasive integration of digital technologies, the surge in cyber threats is increasingly conspicuous. Cyber attackers employ malicious software (Malware) to compromise data integrity and exploit system resources. Tactics include transforming devices into remotely controlled assets or extorting ransom through data encryption. While end users commonly resort to antivirus software with signature-based detection, the protracted and dangered of malware detection necessitates alternative approaches. This study addresses this need by utilizing a honeypot trap system on Google Cloud to analyze suspicious files uploaded by attackers. Evaluated through a signature-based method, these files using 64 antivirus programs underscore the inadequacy of relying solely on this approach, with only three exhibiting success rates exceeding 90%. The majority, 61 antivirus programs, showed success rates predominantly below 70%. This underscores a crucial conclusion: sole reliance on signature-based security falls short in combating contemporary cyber threats. The study advocates for diverse detection techniques, independent or concurrent with signature-based methods, to fortify cybersecurity. The repository containing the honeypot-collected malicious files and Python script is publicly available on Github, serving as a valuable research resource.