A Taxonomic Overview of Prevalent Malware Communication Strategies

Abstract

Malware analysis remains a critical task in cybersecurity, particularly given the prevalent use of network capabilities by many malware samples. Despite the need to discuss and understand the use of networking in malware, there is currently no comprehensive taxonomy to classify the various aspects of malware C&C communication. This lack of taxonomy has resulted in the absence of a categorized overview of the communication strategies utilized by prevalent malware.

Furthermore, no structured data set is available that includes representative samples of common malware families along with their respective network traffic captures, which is crucial to develop new malware networking analysis methods or to improve manual analysis skills.

In this paper, we make three main contributions.

First, we propose a taxonomy for malware C&C communication strategies, adapted and expanded from the Trend Micro botnet taxonomy, to ensure that it can be systematically applied to categorize and describe C&C communication methods more broadly.

Second, we provide an organized summary of the current malware C&C  communication landscape, based on the malware families most frequently submitted to MalwareBazaar, to give researchers an overview of common techniques.

Third, we release a data set containing samples of these prevalent malware families together with live network traffic captures to facilitate research and the development of new tools for malware networking analysis.