A Comprehensive Analysis of Today's Malware and Its Distribution Network: Common Adversary Strategies and Implications

Abstract

Malware has plagued the internet and computing systems for decades. The war against malware has always been an arms race. Researchers and industry have constantly improved detection and prevention methodologies against increasingly more evasive malware. Keeping up with the constantly changing adversary tactics for evading defensive efforts and maintaining an efficient malware supply chain is imperative to stay ahead in the competition. In this paper, we present a large-scale and comprehensive analysis of the current state of malware distribution. For the analysis, we accumulated a dataset that contains 99,312 malware binary samples from 38,659 malware distribution sites over 287 days. Using our dataset, we perform a comprehensive analysis of the collected malware binaries and URLs to provide up-to-date statistics and insights into the adversary strategies. We analyze both malware distribution sites and malware binaries collected from them. Regarding binary analysis, we perform a multifaceted analysis on the characteristics on the collected binaries, including malware family label classification and file similarity-based clustering. With distribution site analysis, we analyze the IP addresses, domains, AS registration distribution and URL lexical distribution of malware distribution sites. We further discuss the statistical relationship between malware families and their distribution domains. Most importantly, we discuss the current trends in malware distribution today and reveal adversary strategies through our extensive amount of analysis results. Then, we suggest future directions for fight against malware distribution.