Responding to malware is like a constant game of whack-a-mole, each “mole” emerging with a vigor seemingly unaffected by the last one’s squashing. To untangle the forces behind these incessant threats, ICSI researchers took a deep dive into the inner workings of the malware machine. Their findings, recognized with an outstanding paper award at the USENIX Security Symposium, point to new opportunities to step up our game in internet security.
The work grew from a collaboration between ICSI and UC Berkeley supported by the Office of Naval Research and the National Science Foundation. In an effort led by UC Berkeley PhD student Juan Caballero, the researchers identified a chain of unique roles within the malware economy, including players who specialize in breaking into systems, players who specialize in extracting value from compromised systems, and players who connect the two. They found that this middle group, known as “pay-per-install” service providers, sell malware distributors access to vulnerable systems for a small fee per installation. Taking advantage of the weak security within the purveyors’ own systems, the researchers successfully infiltrated four pay-per-install vendors to track their activities from the inside. They discovered that the going rate for malware installations at the time was about 1-18 cents per unique install, with prices highest for systems in the U.S. and U.K., slightly lower in other European countries, and lowest in the rest of the world. They also used their inside view to trace the complex relationships among clients and affiliates and detect new malware about 10 days earlier than the leading virus trackers. Gathering this sort of intelligence can enable defenders to share information about new forms of compromise significantly faster than previously possible.
What made ICSI a good place to pursue these projects?
“A key benefit is that ICSI has a great deal of flexibility for building collaborations. We were able to put together big centers and so forth that would have been much harder on a university campus. It’s a much more agile environment. In addition, at a university it can be quite difficult to have long-term full-time researchers on your team, but it’s hugely valuable to have highly experienced staff who are 100% dedicated to doing the work. That’s another important aspect that makes ICSI a terrific place to conduct ambitious, high-impact research.”
Vern Paxson
Distinguished Fellow, ICSI and Co-Founder and Chief Scientist, Corelight Inc.
This story was published in January 2026 as part of a retrospective series highlighting ICSI’s accomplishments and impacts over the years. To learn about our ongoing work, explore our Core Research Themes.