Large-scale detection and measurement of malicious content [Elektronische Ressource] / vorgelegt von Jan Gerrit Göbel

Large-Scale Detection and Measurement ofMalicious ContentInauguraldissertationzur Erlangung des akademischen Gradeseines Doktors der Naturwissenschaftender Universität Mannheimvorgelegt vonJan Gerrit Göbelaus Köln, DeutschlandMannheim, 2011Dekan: Professor Dr. Wolfgang Effelsberg, Universität MannheimReferent: Dr. Felix Christoph Freiling, UniversitätKorreferent: Professor Dr. Christopher Kruegel, University of California, Santa BarbaraTag der mündlichen Prüfung: 27. April 2011Abstract Many different network and host-based security solutions have been developed inthe past to counter the threat of autonomously spreading malware. Among the most commondetection techniques for such attacks are network traffic analysis and the so-called honeypots. Inthis thesis, we introduce two new malware detection sensors that make use of the above mentionedtechniques. The first sensor called Rishi, passively monitors network traffic to automatically detectbot infected machines. The second sensor called Amun follows the concept of honeypots anddetects malware through the emulation of vulnerabilities in network services that are commonlyexploited. Both sensors were operated for two years and collected valuable data on autonomouslyspreading malware in the Internet. From this data we were able to, for example, study the changein exploit behavior and derive predictions about preferred targets of todays’ malware.