Sandnet: Network traffic analysis of malicious software

Christian Rossow; Christian J. Dietrich; Herbert Bos; Lorenzo Cavallaro; Maarten van Steen; Felix C. Freiling; Norbert Pohlmann

doi:10.1145/1978672.1978682

Sandnet: Network traffic analysis of malicious software

Christian Rossow^*, Christian J. Dietrich, Herbert Bos, Lorenzo Cavallaro, Maarten van Steen, Felix C. Freiling, Norbert Pohlmann

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

79 Citations (Scopus)

Abstract

Dynamic analysis of malware is widely used to obtain a better understanding of unknown software. While existing systems mainly focus on host-level activities of malware and limit the analysis period to a few minutes, we concentrate on the network behavior of malware over longer periods. We provide a comprehensive overview of typical malware network behavior by discussing the results that we obtained during the analysis of more than 100,000 malware samples. The resulting network behavior was dissected in our new analysis environment called Sandnet that complements existing systems by focusing on network traffic analysis. Our in-depth analysis of the two protocols that are most popular among malware authors, DNS and HTTP, helps to understand and characterize the usage of these prevalent protocols.

Original language	English
Title of host publication	BADGERS 2011
Subtitle of host publication	Proceedings of the 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security
Place of Publication	New York, NY
Publisher	ACM Press
Pages	78-88
Number of pages	11
ISBN (Print)	978-1-4503-0768-0
DOIs	https://doi.org/10.1145/1978672.1978682
Publication status	Published - 17 Jun 2011
Externally published	Yes
Event	1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, BADGERS 2011 - Salzburg, Austria Duration: 10 Apr 2011 → 10 Apr 2011 Conference number: 1

Conference

Conference	1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, BADGERS 2011
Abbreviated title	BADGERS 2011
Country/Territory	Austria
City	Salzburg
Period	10/04/11 → 10/04/11

Access to Document

10.1145/1978672.1978682

Cite this

@inproceedings{92ebba8f1b39422698e65425f62c2acc,

title = "Sandnet: Network traffic analysis of malicious software",

abstract = "Dynamic analysis of malware is widely used to obtain a better understanding of unknown software. While existing systems mainly focus on host-level activities of malware and limit the analysis period to a few minutes, we concentrate on the network behavior of malware over longer periods. We provide a comprehensive overview of typical malware network behavior by discussing the results that we obtained during the analysis of more than 100,000 malware samples. The resulting network behavior was dissected in our new analysis environment called Sandnet that complements existing systems by focusing on network traffic analysis. Our in-depth analysis of the two protocols that are most popular among malware authors, DNS and HTTP, helps to understand and characterize the usage of these prevalent protocols.",

author = "Christian Rossow and Dietrich, \{Christian J.\} and Herbert Bos and Lorenzo Cavallaro and \{van Steen\}, Maarten and Freiling, \{Felix C.\} and Norbert Pohlmann",

year = "2011",

month = jun,

day = "17",

doi = "10.1145/1978672.1978682",

language = "English",

isbn = "978-1-4503-0768-0",

pages = "78--88",

booktitle = "BADGERS 2011",

publisher = "ACM Press",

note = "1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, BADGERS 2011, BADGERS 2011 ; Conference date: 10-04-2011 Through 10-04-2011",

}

Rossow, C, Dietrich, CJ, Bos, H, Cavallaro, L, van Steen, M, Freiling, FC & Pohlmann, N 2011, Sandnet: Network traffic analysis of malicious software. in BADGERS 2011: Proceedings of the 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security. ACM Press, New York, NY, pp. 78-88, 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, BADGERS 2011, Salzburg, Austria, 10/04/11. https://doi.org/10.1145/1978672.1978682

Sandnet: Network traffic analysis of malicious software. / Rossow, Christian; Dietrich, Christian J.; Bos, Herbert et al.
BADGERS 2011: Proceedings of the 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security. New York, NY: ACM Press, 2011. p. 78-88.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Sandnet

T2 - 1st Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, BADGERS 2011

AU - Rossow, Christian

AU - Dietrich, Christian J.

AU - Bos, Herbert

AU - Cavallaro, Lorenzo

AU - van Steen, Maarten

AU - Freiling, Felix C.

AU - Pohlmann, Norbert

N1 - Conference code: 1

PY - 2011/6/17

Y1 - 2011/6/17

N2 - Dynamic analysis of malware is widely used to obtain a better understanding of unknown software. While existing systems mainly focus on host-level activities of malware and limit the analysis period to a few minutes, we concentrate on the network behavior of malware over longer periods. We provide a comprehensive overview of typical malware network behavior by discussing the results that we obtained during the analysis of more than 100,000 malware samples. The resulting network behavior was dissected in our new analysis environment called Sandnet that complements existing systems by focusing on network traffic analysis. Our in-depth analysis of the two protocols that are most popular among malware authors, DNS and HTTP, helps to understand and characterize the usage of these prevalent protocols.

AB - Dynamic analysis of malware is widely used to obtain a better understanding of unknown software. While existing systems mainly focus on host-level activities of malware and limit the analysis period to a few minutes, we concentrate on the network behavior of malware over longer periods. We provide a comprehensive overview of typical malware network behavior by discussing the results that we obtained during the analysis of more than 100,000 malware samples. The resulting network behavior was dissected in our new analysis environment called Sandnet that complements existing systems by focusing on network traffic analysis. Our in-depth analysis of the two protocols that are most popular among malware authors, DNS and HTTP, helps to understand and characterize the usage of these prevalent protocols.

UR - https://www.scopus.com/pages/publications/79958728571

U2 - 10.1145/1978672.1978682

DO - 10.1145/1978672.1978682

M3 - Conference contribution

AN - SCOPUS:79958728571

SN - 978-1-4503-0768-0

SP - 78

EP - 88

BT - BADGERS 2011

PB - ACM Press

CY - New York, NY

Y2 - 10 April 2011 through 10 April 2011

ER -

Sandnet: Network traffic analysis of malicious software

Abstract

Conference

Access to Document

Other files and links

Fingerprint

Cite this