Nazca: Detecting Malware Distribution in Large-Scale Networks

Abstract—Malware remains one of the most significant secu-rity threats on the Internet. Antivirus solutions and blacklists, the main weapons of defense against these attacks, have only been (partially) successful. One reason is that cyber-criminals take active steps to bypass defenses, for example, by distribut-ing constantly changing (obfuscated) variants of their malware programs, and by quickly churning through domains and IP addresses that are used for distributing exploit code and botnet commands. We analyze one of the core tasks that malware authors have to achieve to be successful: They must distribute and install malware programs onto as many victim machines as possible. A main vec-tor to accomplish this is through drive-by download attacks where victims are lured onto web pages that launch exploits against the users ’ web browsers and their components. Once an exploit is