Inferring internet-scale infections by correlating malware and probing activities

摘要: This paper presents a new approach to infer malware-infected machines by solely analyzing their generated probing activities. In contrary other adopted methods, the proposed does not rely on symptoms of infection detect compromised machines. allows inference malware at very early stages contamination. The aims detecting whether are infected or as well pinpointing exact type/family, if were found be compromised. latter insights allow network security operators diverse organizations, Internet service providers and backbone networks promptly clients' in addition effectively providing them with tailored anti-malware/patch solutions. To achieve intended goals, exploits darknet space employs statistical methods large-scale Subsequently, such activities correlated samples leveraging fuzzy hashing entropy based techniques. is empirically evaluated using 60 GB real traffic 65 thousand samples. results concur that rationale exploiting for worldwide detection indeed promising. Further, demonstrate extracted inferences exhibit noteworthy accuracy can generate significant cyber could used effective mitigation.