Do malware reports expedite cleanup? an experimental study
Marie Vasek, Tyler Moore · 2012
Web-based malware is pervasive. Miscreants compro-mise insecure hosts or even set up dedicated servers to distribute malware to unsuspecting users. This scourge is mainly fought by the voluntary action of private actors who detect and report infections to affected site own-ers, hosting providers and registrars. In this paper we describe an experiment to assess whether sending re-ports to affected parties makes a measurable difference in cleaning up malware. Using community reports of mal-ware submitted to StopBadware over two months in Fall 2011, we find evidence that detailed notices are imme-diately effective: 32 % of malware-distributing websites are cleaned within one day of sending a notice, compared to just 13 % of sites not receiving a notice. The improved cleanup rate holds for longer periods, too – 62 % of web-sites receiving a detailed notice were cleaned up after 16 days, compared to 45 % of websites not receiving a notice. It turns out that including details describing the compromise is essential for the notice to work – send-ing reports with minimal descriptions of the malware was found to be roughly as effective as not sending reports at all. Furthermore, we present evidence that sending mul-tiple notices from two sources is not helpful. Instead, only the first transmitted notice makes a difference. 1