< Call for Paper: RAID '07 | Botnet Monitoring And New Malware Samples >

Some Nepenthes Statistics

Here some updates on the number of autonomous spreading malware we observe with the help of nepenthes. This data is based on a sensor running the latest version of nepenthes on about 16,000 IP addresses. The sensor is online since December 8, 2006, so one month now:
Total Number Of Hits: 6,325,331
Number Of Unique IPs: 8,994
Number Of Unique Malware: 1,555

Average Connections per Day: 950,771
Average Exploits per Day: 242,049

Sorting out some errors and then scanning the remaining 1,497 binaries with the current version of ClamAV yields the following results:
----------- SCAN SUMMARY -----------
Known viruses: 86212
Engine version: 0.88.5
Scanned directories: 1
Scanned files: 1497
Infected files: 1243
Data scanned: 84.47 MB
Time: 17.578 sec (0 m 17 s)

Some of the files are presumably broken due to failed downloads or similar issues, thus the detection rate is presumably slightly better than this 83%. A more in-depth analysis with CWSandbox (new design!) will result in a better analysis...
This entry was posted by Thorsten Holz on Monday, January 8. 2007 at 23:40. and is filed under honeynets. You can leave a response, or trackback from your own blog. All new comments are subject to moderation before being displayed.

Trackbacks

Trackback specific URI for this entry
  1. Interesting Numbers from Nepenthes

    There&#8217;s an interesting post over at the Honeyblog regarding statistics taken from Nepenthes. The were sensors across 16,000 IPs and the monitoring has been underway for a month. Total Number Of Hits: 6,325,331 Number Of Unique IPs: 8,994 Numb...

    Weblog: .:Computer Defense:.
    Tracked: Jan 09, 04:41

Comments

Display comments as (Linear | Threaded)

    No comments


Add Comment


Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
Submitted comments will be subject to moderation before being displayed.