PeerPress

摘要: We propose a new, active scheme for fast and reliable detection of P2P malware by exploiting the enemies' strength against them. Our new works in two phases: host-level dynamic binary analysis to automatically extract built-in remotely-accessible/controllable mechanisms (referred as Malware Control Birthmarks or MCB) malware, followed network-level informed probing detection. design demonstrates novel combination strengths from both host-based network-based approaches. Compared with existing solutions, it is fast, reliable, scalable its scope. Furthermore, can be applicable more than just broadly any that opens service port network communications (e.g., many Trojans/backdoors). develop prototype system, PeerPress, evaluate on representative real-world (including Storm, Conficker, recent Sality). The results show effectively detect existence when MCBs are extracted, occurs an early stage during which other tools BotHunter) typically do not have sufficient information detect. further discuss limitations implications, we believe great complement passive solutions.