Real-Time Detection of Malware Downloads via Large-Scale URL->File->Machine Graph Mining

摘要: In this paper we propose Mastino, a novel defense system to detect malware download events. A event is 3-tuple that identifies the action of downloading file from URL was triggered by client (machine). Mastino utilizes global situation awareness and continuously monitors various network- system-level events clients' machines across Internet provides real time classification both files URLs clients upon submission new, unknown or system. To enable detection events, builds large graph captures subtle relationships among entities i.e. files, URLs, machines. We implemented prototype version evaluated it in large-scale real-world deployment. Our experimental evaluation shows can accurately classify with an average 95.5% true positive (TP), while incurring less than 0.5% false positives (FP). addition, show new as either benign just fraction second, therefore suitable