Network Malware Activity – A View from Honeypot Systems

Abstract

There is little detailed information about the lifetime of network malware and malware infected systems. There is a lot of information about the emergence of some new versions of malware, used security vulnerabilities, methods and the range of infection but they are generally related to the start of life cycle of malware. Much less information is available about what happens next – how long the malware actively is distributed on the network, how long operate infected hosts and how the amount of infected systems fluctuates with time.

The paper presents the results of nearly two years’ operation of honeypot systems, installed on unprotected research network, throwing some lights on the longtime malware activity.