Measuring PUP Prevalence and PUP Distribution through Pay-Per-Install Services
summary
Using 8 billion AV telemetry events from 3.9 million hosts over 19 months, the authors quantify how widespread potentially unwanted programs (PUP) are and how PUP is distributed via pay‑per‑install (PPI) services. They identify publisher popularity (top PUP publishers rank among all software publishers), map who-installs-whom relationships (65% of PUP downloads come from other PUP, 24 PPI services distribute over 25% of PUP), characterize top advertiser programs (browser adware like toolbars/extensions and rogueware), and measure interactions between PUP and malware, finding mostly disjoint distribution.
AI-written summary · about
chapters (16)
- 0:00Start
- 0:21Potential Unwanted Programs (PUP)
- 1:59Evidence of PUP Prevalence
- 2:39Pay-Per-Install (PPI) Ecosystem
- 5:37Comparison with simultaneous Work
- 6:42Datasets
- 7:50Identify PUP Publishers
- 9:42Clustering Publishers
- 12:49Publisher Ranking
- 13:27Road Map
- 13:48Publisher Graph
- 15:03How many PPI services exist?
- 17:05What type of PUP is distributed?
- 18:34How is PUP distributed?
- 19:29PUP - Malware Relationship
- 21:56Summary
related talks
34mWajam: From a Start-up to Massive Spread Adware
19mWhich mobile fraud solution is right for you?
45mFriendly fire: how security software messes up
46mSponsored Session: Malicious Package Trends Compared With Malware Evolution
39mAndroid Malware Trends on a Global Scale
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
15mFighting mobile apps piracy
22mAPT Attribution and DNS Profiling