On the Reliability of Network Measurement Techniques Used for Malware Traffic Analysis

摘要: Malware attacks are increasingly popular attack vectors in online crime. As trends and anecdotal evidence show, preventing these attacks, regardless of their opportunistic or targeted nature, has proven difficult: intrusions happen devices get compromised, even at security-conscious organisations. a consequence, an alternative line work focused on detecting disrupting the individual steps that follow initial compromise essential for successful progression attack. In particular, number approaches techniques have been proposed to identify Command & Control (C2) channel compromised system establishes communicate with its controller. The success C2 detection depends collecting relevant network traffic. traffic volumes increase this is proving difficult. paper, we analyse current ISP-scale measurement from perspective detection. We discuss weaknesses affect provide suggestions improvement.