Do malware reports expedite cleanup? an experimental study

Abstract

Web-based malware is pervasive. Miscreants compromise insecure hosts or even set up dedicated servers to
\ndistribute malware to unsuspecting users. This scourge
\nis mainly fought by the voluntary action of private actors
\nwho detect and report infections to affected site owners, hosting providers and registrars. In this paper we
\ndescribe an experiment to assess whether sending reports to affected parties makes a measurable difference in
\ncleaning up malware. Using community reports of malware submitted to StopBadware over two months in Fall
\n2011, we find evidence that detailed notices are immediately effective: 32% of malware-distributing websites
\nare cleaned within one day of sending a notice, compared
\nto just 13% of sites not receiving a notice. The improved
\ncleanup rate holds for longer periods, too – 62% of websites receiving a detailed notice were cleaned up after
\n16 days, compared to 45% of websites not receiving a
\nnotice. It turns out that including details describing the
\ncompromise is essential for the notice to work – sending reports with minimal descriptions of the malware was
\nfound to be roughly as effective as not sending reports at
\nall. Furthermore, we present evidence that sending multiple notices from two sources is not helpful. Instead,
\nonly the first transmitted notice makes a difference.