On periodic behavior of malware: experiments, opportunities and challenges

Abstract

We notice, in our experiments with three malware samples of Darkcomet, Andromeda, and Zeus, that all three of them generate highly periodic network traffic. In addition, while there are a few works on intrusion detection which are based on this periodic behavior of malware, the prevalence of this behavior among the malware families in the wild is unknown. In this paper, we conduct an extensive experimental study to investigate the networking behavior of 31 different malware families, which belong to two large classes of malware families commonly found in the wild: Remote Administration Tools and Botnet Trojans. We would like to address the question that how likely a malware captured in the wild would generate periodic traffic. The study finds out that 30 out of 31 (96.77%) experimented malware families are found to leave periodic traces in network traffic when they communicate with command and control servers.