CCMSS: The CNCERT cloud based mobile sinkhole system to monitor mobile malware victims in China

In this paper, we propose the CNCERT1 cloud based mobile sinkhole system (CCMSS) to monitor mobile (or smartphone) victims infected by mobile malwares. Different from sinkholes for computer malwares, CCMSS is designed to redirect victim´s flow at malware´s DNS server by considering that most mobile malware victims access Internet through cellular networks in China. CCMSS is deployed in CNCERT cloud to balance victim´s flow from different locations. The monitoring result of CCMSS shows that millions of mobile users are infected by mobile malwares in China, and the spreading of mobile malware is related with region.