Let’s Gossip: Exploring Malware Zero-Day Time Windows by Social Network Analysis
Fiammetta Marulli, Francesco Mercaldo · 2017
The detection mechanism provided by current antimalware technologies expects that security researchers build a signature to uniquely identify the malicious samples. Once obtained, the signature will made available to final users using the update mechanism. This time window, which begins when malware is released and it lasts until the malware is identified, it is called zero-day window and represents the time period in which the malware is able to cause the worst damages because it is undiscovered. In this paper we propose a backward analysis methodology aiming to provide a preliminary estimation of this time window width, mining search engine trend and social network and by applying natural language processing and text analysis.