Analysis of malware download sites by focusing on time series variation of malware

As Internet use increases, it is plagued by malicious activity. In particular, drive-by download attacks have become a serious problem. As part of an exploit-as-a-service ecosystem for drive-by download attacks, malware download sites play a particularly important role for attackers. In this paper, we analyzed approximately 43,000 malware download URLs. Our measurement period is over 1.5 years and studied their long-term behavior. We discovered that some malware download sites survive for a very long time and revives many times, a fact that had not been revealed by previous research. We established three categories by focusing attention on malware variation. Our results showed that 10% of the unchanged category survives for more than 500 days and 10% of the changed occasionally category revives more than 15 times. We also analyzed sites in terms of change in IP address, number of anti-virus signatures, and URL features. We found that each category has different attacker operational and resource characteristics. Using these findings, we discuss how to mitigate the effects of each category.