Measurement and analysis of autonomous spreading malware in a university environment

Abstract

Autonomous spreading malware in the form of bots or worms is a constant threat in today's Internet. In the form of botnets, networks of compromised machines that can be remotely controlled by an attacker, malware can cause lots of harm. In this paper, we present a measurement setup to study the spreading and prevalence of malware that propagates autonomously. We present the results when observing about 16,000 IPs within a university environment for a period of eight weeks. We collected information about 13,4 million successful exploits and study the system- and network-level behavior of the collected 2,034 valid, unique malware binaries. © Springer-Verlag Berlin Heidelberg 2007.