Detection of malicious webmail attachments based on propagation patterns

摘要: Abstract Email remains one of the key media used by cybercriminals for distributing malware. Based on a large data set consisting antivirus telemetry reports, we conduct first comprehensive study properties malicious webmail attachments. We show that they are distinct among general web-borne malware population in terms reach (the number machines to which is downloaded), type and family. Furthermore, attachments unique manner propagate through network. leverage these findings defining novel features propagation patterns. These derived from time-series representation download rates community structure graphs model network paths propagates. features, implement detector provides high-quality detection