A Close Look at a Daily Dataset of Malware Samples - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue ACM Transactions on Privacy and Security Année : 2019

A Close Look at a Daily Dataset of Malware Samples

Résumé

The number of unique malware samples is growing out of control. Over the years, security companies have designed and deployed complex infrastructures to collect and analyze this overwhelming number of samples. As a result, a security company can collect more than 1M unique files per day only from its different feeds. These are automatically stored and processed to extract actionable information derived from static and dynamic analysis. However, only a tiny amount of this data is interesting for security researchers and attracts the interest of a human expert. To the best of our knowledge, nobody has systematically dissected these datasets to precisely understand what they really contain. The security community generally discards the problem because of the alleged prevalence of uninteresting samples. In this paper, we guide the reader through a step-by-step analysis of the hundreds of thousands Windows executables collected in one day from these feeds. Our goal is to show how a company can employ existing state-of-the-art techniques to automatically process these samples, and then perform manual experiments to understand and document what is the real content of this gigantic dataset. We present the filtering steps and we discuss in detail how samples can be grouped together according to their behavior in order to support manual verification. Finally, we use the results of this measurement experiment to provide a rough estimate of both the human and computer resources that are required to get to the bottom of the catch of the day. CCS Concepts: • Security and privacy → Malware and its mitigation; Software reverse engineering; Economics of security and privacy;
Fichier non déposé

Dates et versions

hal-04093576 , version 1 (01-06-2023)

Identifiants

Citer

Xabier Ugarte-Pedrero, Mariano Graziano, Davide Balzarotti. A Close Look at a Daily Dataset of Malware Samples. ACM Transactions on Privacy and Security, 2019, 22 (1), pp.1 - 30. ⟨10.1145/3291061⟩. ⟨hal-04093576⟩

Collections

EURECOM
9 Consultations
1 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More