A lustrum of malware network communication: Evolution & insights Authors: Chaz Lever, Platon Kotzias, Davide Ballzarotti, Manson Anotonkakis Presented by: Sohail Akbar Master of Professional Studies in Digital Security Date: 10-10-2017

Introduction Motivation Problems & Trends Background

Internet security threat Introduction propagation of cybercrime for profit (Zbot,…) Targeted attacks (Aurora,…) Emerging Cyber Warfare (Stuxnet,…)

internet security threat introduction Implications - motivated, well funded adversary - creative attackers – find new vectors to reach victims - adoptive attackers – work actively against defence

Key component - Malware Introduction Malware (Malicious Software) software that fulfils the deliberately harmful intend of an attacker typically installed as a part of compromise or via social engineering Bots, Advance Persistent Threat (APTs) - No more Autonomous - provide remote access to attackers (botmaster) - connect to command and control (C&C) infrastructure - use infected host as platform to lunch malicious activity leverage this Command & Control infrastructure for better defense

motivation INTRODUCTION Malware analysis is at the forefront of fight against internet threats. Both the operational & academic security communities have used dynamic malware analysis Network information derived from such dynamic analysis is used for: - Threat detection - Network Polices - Incident Response - other indicators of compromise

How effective are these Network Signals ? Big question?? How effective are these Network Signals ? What are the ways actually reliable to use these?

DATA SAMPLES

Domain Filtering Invalid domains Benign Domains Spam Domains ` Remove NX domains to reduce the effects of Domain Generation Algorithm (DGA). Reduction from 6.8 M to 1.31M e2LDs. Benign Domains Remove popular domains from Alexa Remove known content delivery Network (CDN) Reduction from 1.31M to 1.21M e2LDS Spam Domains Remove resolutions from binaries with lots of MX lookups Remove resolutions with mail related keywords (i.e mail, smtp,..) Reduction from 1.29M to 329,348 e2LDS `

MALWARE COLLECTION (FILTERED) Collection issue Consistence growth in No. of samples, No. of domains queried and No. of IP addresses Drop in second half of 2014 reflects a failure in our collection infr. No. of malware samples, qnames. e2LDs, & IP according to the execution time of samples

PUP / MALWARE Classification Collection issue Kotzias et al {38} who conduct the same kind of previous work. He observed the same trend in much smaller dataset. Thomas et al measured that Google safe browsing generates 3 times as many detections for PUP as for Malware.

MY Criticism Malware landscape is much diverse and constantly evolving : Large and diverse botnets, APT’s, exploitation techniques, C&C, many more… Examining the malicious code involve a variety of tasks, which are long time consuming and can be challenging. There are chances of getting wrong results to execute the malicious code (Malware) in the sandbox, as it could have different configuration settings. Malware usually, have different payloads to execute based on the configuration of infected hosts. That is, one malware sample may behave differently on different hosts if the hosts, for examples, have different versions of internet browsers.

MY Criticism In this paper writer suggest that “ Network defenders should rely on Automated malware analysis to extract indicators of compromise and not build early detection system” In my point of view, I am not agree and propose for this project to study and analyze the different methods, tools and techniques for early Network-based Malware detection.

Questions!