PNNL

Abstract

Abstract: Drive-by-downloads are malware that push, and then execute, malicious code on a client system without the user's consent. The purpose of this paper is to introduce a discussion of the usefulness of antivirus software for detecting the installation of such malware, providing groundwork for future studies. Client honeypots collected drive-by malware which was then evaluated using common antivirus products. Initial analysis showed that most of such antivirus products identified less than 70% of these highly polymorphic malware programs. Also, it was observed that the antivirus products tested, even when successfully detecting this malware, often failed to classify it, leading to the conclusion that further work could involve not only developing new behavioral detection technologies, but also empirical studies that improve general understanding of these threats. Toward that end, one example of malicious code was analyzed behaviorally to provide insight into next steps for the future direction of this research.