Before we knew it

摘要: Little is known about the duration and prevalence of zero-day attacks, which exploit vulnerabilities that have not been disclosed publicly. Knowledge new gives cyber criminals a free pass to attack any target their choosing, while remaining undetected. Unfortunately, these serious threats are difficult analyze, because, in general, data available until after an discovered. Moreover, attacks rare events unlikely be observed honeypots or lab experiments.In this paper, we describe method for automatically identifying from field-gathered records when benign malicious binaries downloaded on 11 million real hosts around world. Searching set files indicates appeared Internet before corresponding were disclosed. We identify 18 exploited disclosure, previously employed attacks. also find typical lasts 312 days average that, publicly, volume exploiting them increases by up 5 orders magnitude.