Measurement and Analysis of Spyware in a University Environment

Short Description
quantitative study of spyware based on this trace, charac- ….. of spyware activity at the University of Washington, a. large public university with over …

Website: www.cs.washington.edu | Filesize: 152kb

Content
Measurement and Analysis of Spyware in a University Environment
Stefan Saroiu, Steven D. Gribble, and Henry M. Levy
Department of Computer Science & Engineering
University of Washington
{tzoompy,gribble,levy}@cs.washington.edu
Abstract
Over the past few years, a relatively new computing
phenomenon has gained momentum: the spread of “spyware.”
Though most people are aware of spyware, the
research community has spent little effort to understand
its nature, how widespread it is, and the risks it presents.
This paper is a first attempt to do so.
We first discuss background material on spyware, including
the various types of spyware programs, their
methods of transmission, and their run-time behavior.
By examining four widespread programs (Gator, Cydoor,
SaveNow, and eZula), we present a detailed analysis of
their behavior, from which we derive signatures that can
be used to detect their presence on remote computers
through passive network monitoring. Using these signatures,
we quantify the spread of these programs among
hosts within the University of Washington by analyzing a
week-long trace of network activity. This trace was gathered
from August 26th to September 1st, 2003.
From this trace, we show that: (1) these four programs
affect…