Large-scale Malware Experiments: Why, How, and So What? - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2010

Large-scale Malware Experiments: Why, How, and So What?


One of the most popular research areas in the anti-malware industry (second only to detection) is to document malware characteristics and understand their operations. Most initiatives are based on reverse engineering of malicious binaries so as to understand a threat's features. In order to fully understand the challenges faced by a malware operator, it is sometimes necessary to reproduce a scenario where researchers have to manage thousands of infected computers in order to reach a set of objectives. In this paper, we first discuss the reasons why one would want to replicate a botnet and perform experiments while managing it. In our case, our objective was to emulate the Waledac botnet and assess the performance of a mitigation scheme against its peer-to-peer infrastructure. We then present our experimental methodology and explain the technical decisions we take to perform our experiments. Finally, we explain our results, both in terms of the attacks against the Waledac botnet and challenges we faced while creating our experimental environment.
No file

Dates and versions

inria-00536717 , version 1 (16-11-2010)


  • HAL Id : inria-00536717 , version 1


Joan Calvet, José M. Fernandez, Pierre-Marc Bureau, Jean-Yves Marion. Large-scale Malware Experiments: Why, How, and So What?. Virus Bulletin 2010, Sep 2010, Vancouver, Canada. pp.241--247. ⟨inria-00536717⟩
98 View
0 Download


Gmail Facebook X LinkedIn More