Sandnet: Network Traffic Analysis of Malicious Software
Dynamic analysis of malware is widely used to obtain a better understanding of unknown software. While existing systems mainly focus on host-level activities of malware and limit the analysis period to a few minutes, the authors concentrate on the network behavior of malware over longer periods. They provide a comprehensive overview of typical malware network behavior by discussing the results that they obtained during the analysis of more than 100,000 malware samples. The resulting network behavior was dissected in their new analysis environment called Sandnet that complements existing systems by focusing on network traffic analysis. Their in-depth analysis of the two protocols that are most popular among malware authors, DNS and HTTP, helps to understand and characterize the usage of these prevalent protocols.