<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-04093099</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-22T20:42:09+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">A Comparison of Systemic and Systematic Risks of Malware Encounters in Consumer and Enterprise Environments</title>
            <author role="aut">
              <persName>
                <forename type="first">Savino</forename>
                <surname>Dambra</surname>
              </persName>
              <idno type="halauthorid">1324229-0</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Leyla</forename>
                <surname>Bilge</surname>
              </persName>
              <idno type="halauthorid">2234184-0</idno>
              <affiliation ref="#struct-1162205"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Davide</forename>
                <surname>Balzarotti</surname>
              </persName>
              <email type="md5">3a357a4280ad9e06b08c793214fe9c71</email>
              <email type="domain">eurecom.fr</email>
              <idno type="idhal" notation="numeric">937917</idno>
              <idno type="halauthorid" notation="string">656193-937917</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-5957-6213</idno>
              <idno type="RESEARCHERID">http://www.researcherid.com/rid/EKT-8806-2022</idno>
              <idno type="ISNI">http://isni.org/isni/0000000382393268</idno>
              <idno type="VIAF">https://viaf.org/viaf/265384337</idno>
              <idno type="IDREF">https://www.idref.fr/156537923</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Centre De Documentation</forename>
                <surname>Eurecom</surname>
              </persName>
              <email type="md5">808fb6c747947adf4fb3953c09dd1636</email>
              <email type="domain">eurecom.fr</email>
            </editor>
            <funder ref="#projeurop-722642"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2023-06-20 14:11:22</date>
              <date type="whenModified">2024-01-29 15:35:38</date>
              <date type="whenReleased">2023-06-27 13:25:43</date>
              <date type="whenProduced">2023-05-31</date>
              <date type="whenEndEmbargoed">2023-06-20</date>
              <ref type="file" target="https://hal.science/hal-04093099v1/document">
                <date notBefore="2023-06-20"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-04093099v1/file/publi-7067.pdf" id="file-4134337-3599404">
                <date notBefore="2023-06-20"/>
              </ref>
              <ref type="externalLink" target="https://dl.acm.org/doi/pdf/10.1145/3565362"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="118606">
                <persName>
                  <forename>Centre De Documentation</forename>
                  <surname>Eurecom</surname>
                </persName>
                <email type="md5">808fb6c747947adf4fb3953c09dd1636</email>
                <email type="domain">eurecom.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-04093099</idno>
            <idno type="halUri">https://hal.science/hal-04093099</idno>
            <idno type="halBibtex">dambra:hal-04093099</idno>
            <idno type="halRefHtml">&lt;i&gt;ACM Transactions on Privacy and Security&lt;/i&gt;, 2023, 26 (2), pp.1-30. &lt;a target="_blank" href="https://dx.doi.org/10.1145/3565362"&gt;&amp;#x27E8;10.1145/3565362&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">ACM Transactions on Privacy and Security, 2023, 26 (2), pp.1-30. &amp;#x27E8;10.1145/3565362&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-4134337-3599404"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="EURECOM">EURECOM</idno>
            <idno type="stamp" n="OPENAIRE">OpenAIRE</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">A Comparison of Systemic and Systematic Risks of Malware Encounters in Consumer and Enterprise Environments</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Savino</forename>
                    <surname>Dambra</surname>
                  </persName>
                  <idno type="halauthorid">1324229-0</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Leyla</forename>
                    <surname>Bilge</surname>
                  </persName>
                  <idno type="halauthorid">2234184-0</idno>
                  <affiliation ref="#struct-1162205"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Davide</forename>
                    <surname>Balzarotti</surname>
                  </persName>
                  <email type="md5">3a357a4280ad9e06b08c793214fe9c71</email>
                  <email type="domain">eurecom.fr</email>
                  <idno type="idhal" notation="numeric">937917</idno>
                  <idno type="halauthorid" notation="string">656193-937917</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-5957-6213</idno>
                  <idno type="RESEARCHERID">http://www.researcherid.com/rid/EKT-8806-2022</idno>
                  <idno type="ISNI">http://isni.org/isni/0000000382393268</idno>
                  <idno type="VIAF">https://viaf.org/viaf/265384337</idno>
                  <idno type="IDREF">https://www.idref.fr/156537923</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
              </analytic>
              <monogr>
                <idno type="halJournalId" status="VALID">159327</idno>
                <idno type="issn">2471-2566</idno>
                <idno type="eissn">2471-2574</idno>
                <title level="j">ACM Transactions on Privacy and Security</title>
                <imprint>
                  <publisher>ACM</publisher>
                  <biblScope unit="volume">26</biblScope>
                  <biblScope unit="issue">2</biblScope>
                  <biblScope unit="pp">1-30</biblScope>
                  <date type="datePub">2023-05-31</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1145/3565362</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halOldTypology" n="ART">Journal articles</classCode>
              <classCode scheme="halTreeTypology" n="ART">Journal articles</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Malware is still a widespread problem, and it is used by malicious actors to routinely compromise the security of computer systems. Consumers typically rely on a single AV product to detect and block possible malware infections, while corporations often install multiple security products, activate several layers of defenses, and establish security policies among employees. However, if a better security posture should lower the risk of malware infections, then the actual extent to which this happens is still under debate by risk analysis experts. Moreover, the difference in risks encountered by consumers and enterprises has never been empirically studied by using real-world data. In fact, the mere use of third-party software, network services, and the interconnected nature of our society necessarily exposes both classes of users to undiversifiable risks: Independently from how careful users are and how well they manage their cyber hygiene, a portion of that risk would simply exist because of the fact of using a computer, sharing the same networks, and running the same software. In this work, we shed light on both systemic (i.e., diversifiable and dependent on the security posture) and systematic (i.e., undiversifiable and independent of the cyber hygiene) risk classes. Leveraging the telemetry data of a popular security company, we compare, in the first part of our study, the effects that different security measures have on malware encounter risks in consumer and enterprise environments. In the second part, we conduct exploratory research on systematic risk, investigate the quality of nine different indicators we were able to extract from our telemetry, and provide, for the first time, quantitative indicators of their predictive power. Our results show that even if consumers have a slightly lower encounter rate than enterprises (9.8% vs. 12.0%), the latter do considerably better when selecting machines with an increasingly higher uptime (89% vs. 53%). The two segments also diverge when we separately consider the presence of Adware and Potentially Unwanted Applications (PUA) and the generic samples detected through behavioral signatures: While consumers have an encounter rate for Adware and PUA that is 6 times higher than enterprise machines, those on average match behavioral signatures 2 times more frequently than the counterpart. We find, instead, similar trends when analyzing the age of encountered signatures, and the prevalence of different classes of traditional malware (such as Ransomware and Cryptominers). Finally, our findings show that the amount of time a host is active, the volume of files generated on the machine, the number and reputation of vendors of the installed applications, the host geographical location, and its recurrent infected state carry useful information as indicators of systematic risk of malware encounters. Activity days and hours have a higher influence in the risk of consumers, increasing the odds of encountering malware of 4.51 and 2.65 times. In addition, we measure that the volume of files generated on the host represents a reliable indicator, especially when considering Adware. We further report that the likelihood of encountering Worms and Adware is much higher (on average 8 times in consumers and enterprises) for those machines that already reported this kind of signature in the past.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-421532" status="VALID">
          <orgName>Eurecom [Sophia Antipolis]</orgName>
          <desc>
            <address>
              <addrLine>Campus SophiaTech, 450 Route des Chappes, CS 50193 - 06904 Biot Sophia Antipolis cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.eurecom.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-1162205" status="INCOMING">
          <orgName>NortonLifeLock</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="europeanProject" xml:id="projeurop-722642" status="VALID">
          <idno type="number">771844</idno>
          <idno type="program">ERC-2017-COG</idno>
          <idno type="call">ERC-2017-COG</idno>
          <orgName>BITCRUMBS</orgName>
          <desc>Towards a Reliable and Automated Analysis of Compromised Systems</desc>
          <date type="start">2018-04-01</date>
          <date type="end">2023-08-31</date>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>