DMCA
A study of malware in peer-to-peer networks (2006)
Cached
Download Links
| Venue: | IN IMC ’06: PROCEEDINGS OF THE 6TH ACM SIGCOMM ON INTERNET MEASUREMENT |
| Citations: | 16 - 0 self |
BibTeX
@INPROCEEDINGS{Kalafut06astudy,
author = {Andrew Kalafut and Abhinav Acharya and Minaxi Gupta},
title = {A study of malware in peer-to-peer networks},
booktitle = {IN IMC ’06: PROCEEDINGS OF THE 6TH ACM SIGCOMM ON INTERNET MEASUREMENT},
year = {2006},
pages = {327--332},
publisher = {ACM Press}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Peer-to-peer (P2P) networks continue to be popular means of trading content. However, very little protection is in place to make sure that the files exchanged in these networks are not malicious, making them an ideal medium for spreading malware. We instrument two different open source P2P networks, Limewire and OpenFT, to examine the prevalence of malware in P2P networks. Our results from over a month of data show that 68 % of all downloadable responses in Limewire containing archives and executables contain malware. The corresponding number for OpenFT is 3%. Also, most infections are from a very small number of distinct malware. In particular, in Limewire, the top three most prevalent malware account for 99 % of all the malicious responses. The corresponding number for OpenFT is 75%. We also investigate the sources of malicious responses. To our surprise, 28 % of all malicious responses in Limewire come from private address ranges. In OpenFT, the top virus, which accounts of 67 % of all the malicious responses, is served by a single host. Further, our study provides a useful insight into filtering malware: filtering downloads based on the most commonly seen sizes of the most popular malware could block a large portion of malicious files with a very low rate of false positives. While current Limewire mechanisms detect only about 6 % of malware containing responses, our size based filtering would detect over 99 % of them.
Keyphrases
malicious response peer-to-peer network corresponding number p2p network single host ideal medium low rate downloadable response small number current limewire mechanism detect top virus private address filtering downloads useful insight prevalent malware account popular mean false positive popular malware different open source p2p network malicious file little protection distinct malware trading content large portion
