Sandnet: Network Traffic Analysis of Malware Samples

Sandnet is a malware analysis environment focusing on network behavior over extended periods. Christian Rossow from the University of Applied Sciences for Public Administration and Management provides an overview based on the analysis of more than 100,000 malware samples. The work includes an in-depth analysis of the DNS and HTTP protocols commonly used by malware.

Use Cases

• Characterizing malware command-and-control patterns based on network traffic analysis.
• Studying the abuse of DNS and HTTP protocols by malware as mentioned in the description.
• Developing signatures for network intrusion detection systems based on observed malware behavior.
• Comparing long-term network activity of malware samples against short-term host-level analysis.

Strengths

• Analysis is based on a large corpus of more than 100,000 malware samples.
• Focuses on network traffic over longer periods, complementing short-term host analysis.
• Provides in-depth analysis of two prevalent malware protocols, DNS and HTTP.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Row count is unknown, which may limit suitability assessment.
• Last update date is unknown; freshness unverified.

Provenance

Source

Christian Rossow, University of Applied Sciences for Public Administration and Management

Collection Method

Dynamic analysis of malware samples focusing on network traffic.