# Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure
## 1 Introduction  
The increasing demand for cloud solutions in various industries, such as healthcare, finance, education, and government, has driven the rapid growth of the global public cloud services market. According to Forrester, this market is projected to surpass USD 1 trillion by 2026, more than doubling its value of USD 446.4 billion in 2022 [1]. However, the widespread adoption of cloud services has also brought new cybersecurity challenges, including the abuse of cloud and public legitimate services (CLS) as a C&C communication channel. Attackers can exploit the CLS to hide their malicious activities and remotely control compromised systems. This enables them to operate covertly and efficiently, reducing the likelihood of detection. They achieve this by leveraging the trust between the CLS provider and the user, using these services as C&C infrastructure. The capability to mask their actions and remotely manage compromised systems significantly enhances the success rate of adversaries in cyber attacks. Malware examples that have utilized CLS as C&C servers include Hammertoss [2], RegDuke [3], SLUB [4], and DarkHydrus [5]. Hammertoss is a remote access tool that leverages third-party web servers, including LinkedIn, Twitter, and GitHub, to evade detection by security solutions and gain full access to the victim's system. RegDuke is a malware variant that abuses Dropbox by hosting steganographic images containing encrypted malicious commands for covert C&C operations. SLUB is a backdoor identified and analyzed by TrendMicro, which abuses three legitimate platforms--Slack, GitHub, and File.io--for its C&C infrastructure. DarkHydrus is a cyber threat group known to abuse legitimate cloud services, such as Google Drive, for its infrastructure. Traditional anti-malware solutions that rely on known malware signatures or behaviors may not be effective at detecting and preventing such abuses. As a result, ML classifiers have become an increasingly popular tool for detecting threats in the field of cybersecurity. Our proposed work uses static and derived features from the PE file header as ML features to detect the abuse of CLS as C&C channels. The PE file is a standard format for executables, object files, and DLLs in the Windows operating system [6]. It contains information about the structure and layout of an executable file, including the entry point, the code and data sections, and the dependencies of the program. The focus on the PE file format is driven by two primary factors. First, its widespread use in the Windows environment is highlighted in Figure 1, showing that Windows has maintained a dominant market share in desktop operating systems (OS) from 2013 to 2023. Second, Figure 2 indicates that the PE file format is the most commonly submitted among all file types on VirusTotal. * Dataset creation: We have created a unique dataset that includes malware samples initiating network connections to CLS and benign samples making legitimate connections to the Internet. To our knowledge, no previous datasets have specifically addressed this emerging threat; they primarily covered generic malware samples. This dataset, the first of its kind, serves as a valuable resource for training and evaluating ML classifiers to detect the abuse of CLS. * Feature engineering: We tailored informative feature engineering to behaviors that indicate CLS abuse, such as connecting to known CLS domains and making potential C&C API calls. * Feature selection: To identify the most relevant features, we introduced a custom feature elimination (CFE) method designed to determine the exact number of features needed for filter selection approaches. For wrapper-based feature selection, we utilize various techniques, including sequential feature selector forward (SFSF), sequential feature selector backward (SFSB), and recursive feature elimination (RFE). Figure 1: Global distribution of market share among different OS used in desktop PCs [7].