{"id":"11c895c4-6259-4399-81c6-585f4f220457","arxiv_id":"1908.10167","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A large-scale dynamic analysis of 650 malware samples finds that system-wide, multi-process propagation is common (23% of samples), diverse (33 injection signatures), and has not increased in prevalence from 2012 to 2018.","lead":"This paper analyzes 650 real-world malware samples across 65 families and finds that 23% propagate across processes, usually by injecting code into Windows system processes. It introduces a graph structure, the system-wide propagation graph, to describe how malware spreads across processes and execution waves.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline prevalence figures are computed on a family-balanced convenience sample, so they are properties of the sample, not of the malware landscape.","rationale":"The reader's weakest assumption was the representativeness of the single execution environment; the concern raised here is a distinct but related external-validity issue: the family-balanced convenience sample cannot support the paper's landscape-prevalence interpretation of 23.23% and 60%. Both concerns are about generalizing from the measured setup to the wild, so there is partial agreement rather than full disagreement. The paper is methodical, discloses many limitations, and manually verifies multi-process propagation, so no internal contradiction or fraud concern arises. However, Section 4.1's equal-per-family design is not listed as a limitation, and Section 6.1 uses the resulting percentages as if they were landscape estimates. The proposed reweighting test would settle whether the headline percentages survive an adjustment for family prevalence. Since the reader already assigned CONDITIONAL, this concern does not change the verdict; it strengthens the condition that the reported prevalence numbers be interpreted as sample-specific descriptive statistics unless reweighting confirms their generality.","tokens_in":28217,"tokens_out":9195,"duration_ms":97756,"concrete_test":"Use an independent large Windows-malware corpus with family labels (e.g., Malrec's 66,301 samples with AVClass labels, or a fresh VirusTotal sample spanning 2012-2018) to estimate real-world family frequencies. Reweight the paper's 650 samples, or the per-family counts, by those frequencies and recompute the multi-process percentage, the execution-wave percentage, and the yearly averages in Figures 13-15. If the reweighted multi-process percentage moves materially away from 23.23% (e.g., outside roughly 18-30%) or the yearly trend direction changes, the headline prevalence claims are artifacts of family balancing rather than measurements of the malware landscape.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.1 constructs the dataset by choosing 65 families and exactly 10 samples per family, sourced from kernelmode.info, VirusTotal, and similar repositories, with no sampling frame tied to real-world family frequencies. The headline answer to RQ1, '23.23% of samples perform multi-process propagation' (151/650), is the unweighted mean over this constructed sample: each family contributes equal weight, even though propagation-heavy families such as Madangel (10/10), Natas, Emotet, TinyBanker, and Razy (9/10) are balanced against 25 families with no multi-process samples at all. The same design affects the 60% execution-wave figure and the yearly averages in Section 5.4.1. Section 6.1 compares the 23.23% figure with Palo Alto's 13.5% and Ugarte et al.'s 15.6% and attributes the difference to methodology, but sample design is a competing explanation. The 'strict lower-bound' caveat in Section 4.5 addresses only under-detection by the sandbox; it does not address over- or under-representation of propagation-heavy families in a convenience sample. Thus the central claim that 'almost a quarter of malware samples rely on host-based propagation' is not supported by the data design unless the family balance is shown to match wild prevalence.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents a large-scale empirical study of host-based (system-wide) malware propagation. It introduces the system-wide propagation graph (SPG), a directed graph whose nodes are execution waves and whose edges are control-flow transitions, with process-depth, wave-depth, and SPG-width measures. Using the authors' Minerva taint-based whole-system emulation framework, the paper analyzes 650 Windows malware samples from 65 families (10 samples per family) spanning 2012-2018. It reports that 23.23% of samples (151/650) exhibit multi-process propagation, that 60% of samples exhibit multiple execution waves, that 33 distinct API-level propagation signatures were observed, and it analyzes target processes, code-injection versus dropper behavior, sensitive API usage in initial versus non-initial processes, temporal trends, and inter-family consistency. The paper includes detailed case studies of unusual injection techniques and an explicit discussion of limitations in Section 6.2.","tokens_in":28343,"tokens_out":5361,"duration_ms":51481,"significance":"If the quantitative claims hold, this is one of the first systematic, large-scale characterizations of system-wide propagation, and the SPG formalism plus the manually refined signature catalog (33 API-level signatures) could be valuable resources for the malware-analysis community. The authors deserve credit for manually verifying multi-process execution across the dataset, for presenting concrete case studies (e.g., the ZwCreateUserProcess hooking injection), and for explicitly stating in Section 6.2 that the single-environment, 25-second, no-interaction setup will miss behaviors. The main risk to significance is external validity: the headline prevalence figures are computed on a family-balanced convenience sample in one execution environment, so they are properties of that sample and environment rather than of the wider malware landscape. The paper's comparisons to prior work (Section 6.1) attribute differences to methodology without ruling out dataset-composition effects.","major_comments":[{"comment":"The headline prevalence figures, including the 23.23% multi-process figure (151/650) and the 60% execution-wave figure, are unweighted statistics over a deliberately family-balanced sample: exactly 10 samples per family, with no sampling frame tied to real-world family prevalence. As Table 2 shows, propagation-heavy families (Madangel 10/10, Natas 9/10, Emotet 9/10, TinyBanker 9/10, Razy 9/10) are counterbalanced by 25 families with zero multi-process samples. Section 6.1 compares 23.23% with Palo Alto's 13.5% and Ugarte et al.'s 15.6% and attributes the difference to methodology, but family-balance is a competing explanation. Please either rephrase all prevalence claims as applying to the curated family-balanced sample, or provide evidence or weighting that the 65-family sample approximates wild prevalence.","section":"4.1 Data collection; 6.1 Answers to research questions"},{"comment":"The study relies on a single 25-second run per sample, with no user interaction, a vanilla Windows 7 32-bit guest, and no benign applications beyond standard Windows processes. While Section 6.2 honestly acknowledges that this misses browser-injection behaviors and 64-bit-only techniques, the 'strict lower-bound' caveat in Section 4.5 addresses only under-detection within this environment, not the effect of the environment choice on the counts. The abstract's claim of a 'systematic study' of the 'malware landscape' and the RQ1 answer 'almost a quarter of malware samples rely on host-based propagation' should carry explicit qualifiers about the execution environment and the curated sample.","section":"4.3 Experimental set up; 4.5 False positive and false negative elimination; 6.2 Limitations"},{"comment":"The 99% API-call similarity threshold is a load-bearing component of the measurement pipeline: it determines which processes are declared over-tainted false positives and thus which samples count as multi-process. The paper describes the heuristic but provides no sensitivity analysis, no count of how many samples or processes were removed by it, and no independent ground-truth validation of the threshold. A different threshold could plausibly change the 151/650 count. Please report the number of processes evaluated and removed, and show how the prevalence results vary across a range of thresholds around 99%.","section":"4.5 False positive and false negative elimination"},{"comment":"The RQ4 conclusion of 'no consistent change over the years' is based on yearly averages computed over the 10-per-family balanced sample, whose family composition differs by year (Figure 3). Because propagation behavior is highly family-dependent (e.g., Madangel 10/10 vs. many families with 0/10), the yearly fluctuation in average process count and in new-signature counts may reflect family-mix artifacts rather than temporal evolution. Please control for family composition (e.g., per-family-year analysis) or explicitly limit the temporal claim to the sample's family distribution.","section":"5.4.1 Propagation evolution; Figures 13-15"}],"minor_comments":[{"comment":"The SPG-width column header reads '1 2 4 4 5 6 7', which appears to be a typo; it should likely be '1 2 3 4 5 6 7' or the duplicate '4' should be corrected.","section":"Table 5"},{"comment":"The text says 'Table 6 shows the names of the most targeted processes', but the data appears in Figure 6; the cross-reference should be corrected.","section":"5.2.1 Target processes"},{"comment":"The definition of SPG-width as 'the maximum number of non-cyclic paths from the entry-point to all of the leaf nodes' is ambiguous: it could mean the total number of such paths, the maximum over leaves, or the number of leaves. Since this metric is reported in Table 5 and used in the RQ2 discussion, the definition should be clarified.","section":"Definition 4 (Section 3)"},{"comment":"The sentence 'All of the statistics we report in this paper are post false-positive elimination, including the input data set described in 4.1' is confusing, since the dataset was collected before analysis; rephrase to state that reported statistics exclude samples that failed to execute or were removed by the elimination step.","section":"4.5 False positive and false negative elimination"},{"comment":"The per-family signature notation in Table 8 (e.g., '(2, 2, 1) (17, 1, 1)') is compact but lacks an explicit legend in the caption; adding a one-line explanation of the triple (signature ID, injection count, sample count) would improve readability.","section":"Table 8"},{"comment":"The abstract and conclusion use phrases like 'systematic study on many real-world samples' and 'system-wide propagation in the malware landscape' without restating the limitations that Section 6.2 imposes; adding a sentence with the 'lower-bound, single-environment' qualifier would align the claims with the evidence.","section":"Abstract; Conclusion"}],"recommendation":"major_revision","confidential_remarks":"This is a borderline case. The measurements appear carefully performed and the SPG formalism plus the signature catalog are useful contributions, but the central prevalence claims are currently framed as properties of 'the malware landscape' when the design is a family-balanced convenience sample in a single execution environment. The paper needs either a reweighting or a consistent reframing to 'in our curated sample', plus sensitivity analysis for the 99% threshold, before the headline claims are supportable. The heavy reliance on the companion Minerva paper [24] is acceptable if that paper is available to reviewers. I would not reject outright, but the required changes are structural rather than merely editorial."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a solid empirical study with one overclaim in the headline: \"23.23% of samples perform multi-process propagation\" is the unweighted mean over a family-balanced convenience sample, not an estimate of wild prevalence. The stress-test note is correct. Section 4.1 selects 65 families and ten samples per family, so propagation-heavy families (Madangel, Natas, Emotet, TinyBanker, Razy) carry equal weight with 25 families that show zero multi-process samples. The paper's Section 6.1 comparison with Palo Alto's 13.5% and Ugarte's 15.6% attributes the difference to methodology, but sample design is a competing explanation. The \"strict lower-bound\" caveat in Section 4.5 only addresses under-detection by the sandbox, not family over-representation.\n\nWhat's genuinely new: the SPG formalization (simple but workable), the 33 hand-verified propagation signatures, and the measurements of process-depth, wave-depth, and SPG-width across 650 samples spanning 65 families. This is the first systematic, manually verified characterization of system-wide propagation at this scale. The case studies—CallWindowProcA chain, ZwCreateUserProcess hooking, no-explicit-PID injection—are detailed and useful. The paper is honest about its environmental limitations (25-second recording, no user interaction, Windows 7 32-bit) in Section 6.2. The citation pattern is fair: the author leans on his own prior work for Minerva and Tartarus, but that's the natural base for this study, and the broader literature is covered.\n\nSoft spots, in proportion. (1) The headline prevalence is the main issue; it should be framed as \"in our sample\" or reweighted by family prevalence. (2) Single run per sample, no interaction: the paper discloses this but doesn't bound how many behaviors are missed. (3) The 99% API-overlap false-positive filter has no measured false-negative rate; \"so far we have not found any false positives\" is not a substitute. (4) The yearly trends in Section 5.4.1 are read off averages without statistical tests—fine for descriptive purposes, but the \"no evidence of change\" claim is weak. (5) The data and framework aren't released, so independent replication isn't possible; that's a real limitation given the instrument is the author's own Minerva system.\n\nWho this is for: malware analysts and sandbox designers. They'll get a useful map of what to expect—which processes get targeted, which API signatures appear, how families differ in consistency. Deserves a serious referee because the empirical content is substantial and the flaws are fixable with framing/reweighting, not load-bearing.","headline":"Solid empirical map of malware propagation with a headline prevalence number that overreaches because of the family-balanced convenience sample.","tokens_in":28966,"tokens_out":4772,"would_cite":true,"duration_ms":40920,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A 650-sample census finds 23.23% of malware propagates across multiple processes.","keywords":["malware propagation","multi-process execution","execution waves","dynamically generated code","code injection","system-wide propagation graph","dynamic taint analysis","malware sandbox"],"falsifier":"Re-run a representative subset of these 650 samples on a 64-bit Windows 10 guest with an open browser, simulated user activity, and a longer recording window, then count multi-process samples; if the fraction moves well above 23.23%, or if samples known to inject into browsers still show no propagation, the single-environment numbers are not a stable estimate of in-the-wild behavior.","tokens_in":27871,"feed_emoji":"🦠","tokens_out":5960,"duration_ms":56079,"temperature":0.7,"pith_summary":"The paper sets out to give the first large-scale, systematic picture of system-wide malware propagation: how often malware spreads into multiple processes, how many different techniques it uses, where its sensitive behavior lands, and how that has changed over time. It analyses 650 samples from 65 families (10 per family) spanning 2012 to 2018 in a taint-tracking sandbox and condenses each execution into a system-wide propagation graph. The headline findings are that 23.23% of samples propagate across processes, 60% generate multiple execution waves of dynamically generated code, and the multi-process techniques reduce to 33 API-level signatures. These numbers give defenders and sandbox designers a grounded baseline for what normal malware propagation looks like, replacing anecdotal technique lists.","feed_headline":"Malware census: 23% of samples spread across processes","feed_subtitle":"First balanced 650-sample study maps how deeply and widely real Windows malware spreads.","key_machinery":"The load-bearing object is the system-wide propagation graph (SPG), a directed weakly-connected graph whose nodes are execution waves and whose edges are control-flow transitions, with a designated entry node. An execution wave is each round of dynamically generated code identified by an information-flow model, regardless of which process or thread wrote it, which lets the study track unpacking and injected code without hooking common APIs such as CreateRemoteThread. The SPG organizes the raw taint trace into process-depth, wave-depth, and width, and it is the substrate for every statistic and signature in the paper.","core_discovery":"The central claim is that system-wide propagation is prevalent, diverse, and behaviorally significant in the modern malware landscape. Using the Minerva sandbox's whole-system taint-based execution tracking, the author defines each malware execution as a system-wide propagation graph (SPG): nodes are execution waves, meaning rounds of dynamically generated code, and edges are control-flow transitions between them, with process information attached. Analysing 650 samples balanced across 65 families, the paper finds 151 samples (23.23%) with multi-process propagation, 40 families (62%) containing at least one such sample, 393 samples (60%) with multiple execution waves, and 33 distinct API-level propagation signatures, of which the classic OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread chain accounts for 174 of 417 injections (41.7%). Behaviorally, non-initial processes carry most Internet- and security-related API calls, while initial processes carry most of the code and most dynamically generated waves. The author concludes that propagation is a steady, diverse, long-standing feature rather than a growing one: no consistent upward trend appears from 2012 to 2018, and most novel signatures were invented before 2015.","pith_inferences":["Pith inference: if the same 650 samples were re-run in a 64-bit environment or with an active browser and user interaction, the multi-process fraction would likely rise, because the paper itself notes that browser-injecting and 64-bit-only techniques are invisible in its setup.","Pith inference: the SPG depth and width metrics could serve as features for malware family classification, since the paper reports that 83% of samples in a family either share propagation signatures or do not propagate at all.","Pith inference: the paper's 'strict lower bound' framing suggests its percentages should be read as environmental baselines rather than true upper limits on in-the-wild behavior."],"forward_implications":["Detection and analysis pipelines that watch only the first process will miss roughly a quarter of samples; multi-process tracing is needed to see their full behavior.","Because 60% of samples generate code dynamically, static unpacking alone is insufficient, and execution-wave tracking is a practical requirement for complete analysis.","The classic OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread chain remains the single highest-value detection target, but the 33 observed signatures show that detectors keyed to one API sequence will be evaded.","Malicious network and privilege operations concentrate in non-initial processes, so sandboxes that inspect only the initial process will under-report command-and-control and privilege-escalation behavior.","There is no monotonic increase in multi-process propagation or novel signatures over 2012 to 2018, so defenses should treat system-wide propagation as a steady baseline rather than a growing trend."],"supporting_citations":[{"why":"Supplies the Minerva taint-tracking framework whose execution traces form the raw data for all statistics.","marker":"[24]"},{"why":"Contributes the cross-process taint propagation and execution-wave detection method that the SPG builds on.","marker":"[25]"},{"why":"Provides the 15.6% multi-process and 78.7% packed-wave baselines the paper compares against to argue for broader coverage.","marker":"[33]"},{"why":"Offers a comparison point for the proportion of samples with self-modifying or dynamically generated code.","marker":"[9]"},{"why":"Offers a comparison point for hidden-code extraction percentages.","marker":"[21]"},{"why":"Precedent large-scale dynamic-analysis study whose behavioral categories inform the research questions.","marker":"[5]"},{"why":"Supplies family ground truth used to balance and label the 65-family data set.","marker":"[28]"},{"why":"Supplies an industry measurement of code-injection prevalence to contrast with the paper's figure.","marker":"[26]"}],"fun_headline_variants":["23% of malware samples spread system-wide","Malware spread: 33 distinct system-wide techniques","System-wide malware spread is steady, not growing","Most malware's system-wide tricks predate 2015"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central assumption is that one fixed execution environment, meaning 32-bit Windows 7 with no user interaction, a 25-second recording window, and no running browsers or office applications, shows enough of a sample's behavior to characterize how that malware propagates in the wild.","fun_headline_variants_meta":{"raw":{"variants":["23% of malware samples spread system-wide","Malware spread: 33 distinct system-wide techniques","System-wide malware spread is steady, not growing","Most malware's system-wide tricks predate 2015"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000267,"raw_usage":{"total_tokens":1589,"prompt_tokens":898,"completion_tokens":691,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":514,"completion_tokens_details":{"reasoning_tokens":630}},"tokens_in":514,"tokens_out":691,"duration_ms":7184,"temperature":1.0,"reasoning_tokens":630,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T10:49:17.673666+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run a representative subset of these 650 samples on a 64-bit Windows 10 guest with an open browser, simulated user activity, and a longer recording window, then count multi-process samples; if the fraction moves well above 23.23%, or if samples known to inject into browsers still show no propagation, the single-environment numbers are not a stable estimate of in-the-wild behavior.","supporting_citations":[{"cited_title":"Precise system-wide concatic malware unpacking","cited_arxiv_id":"1908.09204","evidence_quote":"Supplies the Minerva taint-tracking framework whose execution traces form the raw data for all statistics."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the 15.6% multi-process and 78.7% packed-wave baselines the paper compares against to argue for broader coverage."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Offers a comparison point for hidden-code extraction percentages."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Precedent large-scale dynamic-analysis study whose behavioral categories inform the research questions."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies an industry measurement of code-injection prevalence to contrast with the paper's figure."}],"review_version":1}