# Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure
## 4 Methodology  
### Data Collection  
In this study, we utilized a dataset obtained from VirusTotal [28] between 2017 and 2021, which encompassed various malware formats. Our research specifically focused on PE files that abuse CLS as a C&C infrastructure.  
To collect malware samples, we leveraged the VirusTotal Intelligence Agent coupled with a custom Python script to extract samples exhibiting communication with known CLS-hosted domains listed in Table 2. The remaining corpus was executed in a controlled Cuckoo sandbox environment [29], retaining only samples demonstrating CLS domain connections for our final experimental dataset, as depicted in Figures 5 and 6. We excluded any samples not connecting to the CLS domain.  
Additionally, the benign samples included in the dataset were obtained from the sources of cnet [30] and sourceforge [31]. These benign programs were also verified by submitting them to VirusTotal to obtain anti-virus detection scores. If the detection score was found to be zero, we further executed it in a controlled sandbox environment to verify its internet connectivity. Only samples that were determined to have zero detection scores and internet connections were ultimately included in the dataset.  
\begin{table}
\begin{tabular}{c c c} \hline \hline \multicolumn{4}{c}{**Names of the CLS Domains**} \\ \hline api-content.dropbox.com & api.twitter.com & docs.google.com \\ mail.google.com & chat.google.com & classroom.google.com \\ sheets.google.com & slides.google.com & storage.google.com \\ mail.google.com & smtp.gmail.com & onedrive.com \\ dropbox.com & twitter.com & github.com \\ pastebin.com & raw.githubusercontent.com & api.twitter.com \\ dev.twitter.com & publish.twitter.com & apps.twitter.com \\ status.twitter.com & youtube.com & twitter.com \\ docs.google.com & script.google.com & translate.google.com \\ storage.google.com & spreadsheets.google.com & api.slack.com \\ app.slack.com & slack.com & gmail.com \\ hotmail.com & outlook.com & amazonaws.com \\ azure.com & portal.office.com & discord.com \\ telegram.com & instagram.com & OneNote.com \\ Teams.com & Evernote.com & publish.twitter.com \\ apis.google.com & imap.gmail.com & m.youtube.com \\ aws.amazon.com & & \\ \hline \hline \end{tabular}
\end{table}
Table 2: CLS domains abused as C&C infrastructure.  
Figure 5: Detailed workflow for extracting a sub-dataset from the VirusTotal datasets.  
The initial dataset was imbalanced, with 3067 malicious and 3652 benign samples. To ensure a balanced dataset and prevent classifier bias, the extra benign samples were removed, resulting in a balanced dataset that retained the same characteristics as the remaining benign samples. To ensure that the removal of extra benign samples did not compromise the dataset's quality, we retained the original characteristics of the remaining benign samples. Since the collection of benign samples was based solely on connections to the internet and VirusTotal's detection score of zero, removing the extra benign samples did not alter the dataset's properties. Therefore, we were able to balance the dataset without compromising its quality, ensuring that the evaluation of classifier accuracy was based on a reliable and representative dataset.  
Figure 6: Illustrative overview of the proposed detection system.  
The experiment, involving the extraction of a sub-dataset from the VirusTotal dataset, the parsing of PEs, and the execution of malware and benign samples in a Cuckoo sandbox [29], was carried out on a machine powered by an Intel Xeon (Skylake IBRS) CPU running at 2.2 GHz, equipped with 64 GB RAM, and using Ubuntu 20.04.1 LTS amd64 as its operating system.  
Our dataset is unique and valuable to the field of cybersecurity as it includes examples of malware abusing CLS as a C&C channel, a type of threat that has not been well-represented in previous datasets.