Automating Malware Scanning Using Workflows

Identifying websites hosting malicious code is a priority for helping protect consumers using the web and for the collection of malicious code for analysis by malware researchers. We have been running an InternetNZ sponsored study where homepages of almost all New Zealand Web servers are scanned on a regular basis by a set of client honeypots. This paper reflects upon our experience of running moderate scale scans over a period of several months manually and identifies some requirements for automation of such a system using workflow and related middleware.