TWC: Medium: Collaborative: Know Thy Enemy: Data Mining Meets Networks for Understanding Web-Based Malware Dissemination

基于网络的恶意软件是如何传播的？我们使用基于网络的恶意软件来描述通过网站传播的恶意软件，以及社交网络中的恶意帖子。我们正在与基于网络的恶意软件分销商进行军备竞赛；在任何战争中，知识就是力量。我们对他们了解得越多，我们就能更好地为自己辩护。我们的目标是通过创建“MalScope”来了解基于网络的恶意软件的传播，MalScope是一套方法和工具，使用尖端的方法来构建恶意软件传播的时空模型、生成器和采样技术。从科学的角度来看，该项目汇集了两个学科：数据挖掘和网络安全。结果是一套新颖、复杂、可扩展的技术和模型，将增强我们对大规模恶意软件传播的理解。我们使用两种基于网络的恶意软件传播数据：(1)用户机器访问危险网站并下载基于网络的恶意软件；(2) Facebook用户暴露在恶意帖子中。我们已经拥有并将继续从我们的行业合作伙伴（例如赛门铁克的WINE项目）、开放获取项目或我们自己收集的数据（例如MyPageKeeper）获取更多数据。我们的工作更广泛的影响是，它将为最终用户和行业开发安全解决方案。15分钟的网络中断会给一家200名员工的公司造成约4万美元的损失，而身份盗窃平均每人造成约1500美元的损失。通过更好地了解敌人，安全研究人员和行业可以更有效地阻止互联网威胁的相互关联的表现：身份盗窃，创建僵尸网络和DoS攻击。私人顾问公司有技术转移的记录，与工业实验室（雅虎、微软、赛门铁克、美国电话电报公司、IBM）、国家实验室（LLNL、桑迪亚）、开源软件（“Pegasus”）和衍生创业公司（StopTheHacker）合作。教育方面的影响包括开发一门新课程，提供公开可用的教育材料和开源软件。

How does web-based malware spread? We use the term web-based malware to describe malware that is distributed through websites, and malicious posts in social networks. We are in an arms race against web-based malware distributors; and as in any war, knowledge is power. The more we know about them, the better we can defend ourselves. Our goal is to understand the dissemination of web-based malware by creating "MalScope", a suite of methods and tools that uses cutting-edge approaches to build spatiotemporal models, generators and sampling techniques for malware dissemination. From a scientific point of view, this project brings together two disciplines: Data Mining and Network Security. The outcome is a suite of novel, sophisticated, and scalable techniques and models that will enhance our understanding of malware dissemination at a large scale. We use two types of web-based malware dissemination data: (1) user machines accessing dangerous sites and downloading web-based malware; and (2) Facebook users being exposed to malicious posts. We already have and will continue to obtain more data from our industry partners (e.g. Symantec's WINE project), open-access projects, or collect on our own (e.g MyPageKeeper).The broader impact of our work is that it will enable the development of security solutions for end-users and industry. A 15-minute network outage costs a 200-employee company about $40K, while identity theft costs about $1,500 per person on average. By knowing the enemy better, security researchers and industry can more effectively stop the interconnected manifestations of Internet threats: identity theft, the creation of botnets, and DoS attacks. The PIs have a track record of technology transfer, with collaborators at industrial labs (Yahoo, MSR, Symantec, AT&T, IBM), national labs (LLNL, Sandia), open-source software (``Pegasus''), and spin-off startups (StopTheHacker). Educational impacts include developing a new course, providing publicly available educational material, and open-source software.