Collecting Internet Malware Based on Client-side Honeypot

With the improvement of software security, attacks based on RPC vulnerabilities declined, however, atta-cks based on client application software vulnerabiliti-es have increased. Such client application software includes web browsers, Email client and Office. The spread of malware using these software vulnerabiliti-es has become a severe threat to today’s Internet. In allusion to this kind of threat, this paper designed an Internet malware collecting system based on client-side honeypot. This system can not only collect malware but also detect malicious website. It uses a unique network crawler based on client-side attack techniques to collect source of URL, and it collects URL and attachments from emails, then it creates software processes to open URL or files, and uses a device-drive monitor to detect malicious behaviors. It gives an alarm and locates the malicious file, and sends the malware coming through the Internet to the collecting server. We introduce the design and imple-ment of this system and give the results.