# Investigating IPTV Malware in the Wild
## 3 Implementation  
Requirements for the framework were elicited through secondary research of the existing literature on the topics of malware forensics and the illegal IPTV ecosystem, which enabled the gathering of requirements for the collection and analysis of malware from illegal IPTV technologies. Exploratory research consisting of analysing a sample of 1555 illicit IPTV websites in AlienVault OTX and VirusTotal was also completed to obtain the requirements. The research results allowed the identification of the types of malwares in illicit IPTV websites, determining the approaches for detecting and collecting malware from these websites and establishing the methodology and best practices of the framework for collecting and analysing a dataset of illegal IPTV technologies.  
Figures 1 and 2 present the overall methodology and a high-level data flow diagram, respectively. The software solution has a client-server structure with an API \"dispatcher\" server to handle requests from a \"requester\" client. This can enable multiple users with requester clients to issue requests to the dispatcher, providing scalability.  
Figure 1: Flow chart of the framework’s automated malware collection and analysis methodology.  
The IITMAF consists of several components working together to support the investigations for the IPTV ecosystem. A web scraper was designed and implemented for the collection of malicious scripts and files. A Tor requester was implemented in the scraper so that the anonymity of the investigator was ensured. For the collected artefacts, both file-based and fileless static analysers were included in the framework since, as explained previously, malicious actions and objectives are sometimes provided within a shellcode/script format. In Figure 2 below, a detailed data flow diagram of how these modules interact with each other is given.  
The development environment of the IITMAF's automated software solution consisted of a Windows 10 PC with Python 3.8.6 installed. Visual Studio Code was selected for the IDE, as it supports Python and integrates with GitHub. Moreover, Tor was installed and configured to run as a Windows service to enable the IITMAF software solution to make anonymous HTTP requests.  
The dispatcher (see Figure 2) provides a REST API that enables the collection and analysis of malware from illegal IPTV technologies. It serves several API endpoints that are called by the requester client to submit URLs. While the API is currently configured to run locally, it can be configured to make the API accessible over the internet, enabling any cybersecurity professional to identify and analyse malware in the illegal IPTV ecosystem. Additionally, the API endpoints can be accessed using Curl, Postman, or any programming language that can initiate and handle HTTP endpoints, potentially allowing organisations, such as intellectual property offices, to use the IITMAF as a threat feed for providing cyber threat intelligence.  
The dispatcher has four endpoints, consisting of endpoints for scraping URLs from a webpage; iteratively scraping URLs from a website; static analysis; and dynamic analysis. The requester client is used to submit the dataset of illicit IPTV URLs to the dispatcher API server sequentially and process the results to generate a report for each URL submitted. This allows multiple URLs to be submitted to the API and be analysed without having to manually submit every URL.