Automated Classification of C&C Connections Through Malware URL Clustering

摘要: We present WebVisor, an automated tool to derive patterns from malware Command and Control (C&C) server connections. From collective network communications stored on a large-scale dataset, WebVisor establishes the underlying among samples of same families (e.g., in terms development tools). focuses C&C channels based Hypertext Transfer Protocol (HTTP). First, it builds clusters statistical features HTTP-based Uniform Resource Locators (URLs) dataset. Then, conducts fine-grained, noise-agnostic clustering process, structure semantic URLs. experimental results using software prototype real-world datasets.