I hacked a script to retrieve the virustotal results for the files mentioned in the paris database, and store the results in the paris database so I could query them. Unfortunately dionaea does not submit to virustotal.com (yet), therefore there are signatures missing for 'some' (75%) files. Afterwards I designed a queries to retrieve some stats about different things.

As I was interested in the share of Conficker attacks, I decided to retrieve some numbers from the paris database.
As I don't know which files count as Conficker, I had to rely on av vendor signatures.

SELECT
	strftime('%Y-%m-%d', connection_timestamp, 'unixepoch') AS whenever,
	total,
	COUNT(*) AS hits,
	ROUND((CAST(COUNT(*)*100 AS FLOAT) / CAST(total AS FLOAT)),2) AS cut,
	av_result
FROM 
	downloads
	NATURAL JOIN connections
	LEFT OUTER JOIN avs ON ( av_md5_hash = download_md5_hash AND av_vendor = 'Kaspersky')
	JOIN (
		SELECT 
			COUNT(*) AS total,  
			strftime('%Y-%m-%d', x.connection_timestamp, 'unixepoch') AS pd 
		FROM 
			downloads AS d 
			NATURAL JOIN connections AS x 
		GROUP BY 
			strftime('%Y-%m-%d', x.connection_timestamp, 'unixepoch')
		) ON(pd = strftime('%Y-%m-%d', connection_timestamp, 'unixepoch'))
GROUP BY
	strftime('%Y-%m-%d', connection_timestamp, 'unixepoch'),
	av_result
ORDER BY
	strftime('%Y-%m-%d', connection_timestamp, 'unixepoch') ASC,
	COUNT(*) DESC,
	av_result ASC

Conficker dominates, about 80% of all successful attacks on the honeypot are Conficker. Paris was a /23, 512 ips, ~88000 successful Conficker attacks within 24 hours is 61 attacks per minute, more than one successful attack a second(!).

The ”-” in the signature indicates Kaspersky did not provide a signature for the file, ”(null)” means virustotal had no match for the file.

First, retrieve the total number of unique files:

SELECT 
	COUNT(DISTINCT download_md5_hash) FROM downloads;

2064 files in a week, good catch.

Then, the number of files unknown to virustotal:

SELECT COUNT(DISTINCT download_md5_hash)
FROM 
	downloads 
	LEFT OUTER JOIN avs ON (av_vendor = 'Kaspersky' AND av_md5_hash = download_md5_hash) 
WHERE
	av_result IS NULL

1624 files unknown to virustotal, thats about 78% of the total.

Maybe the files are unknown as the download failed, and we received an broken sample? To verify we count the number of downloads for files unknown to virustotal.

SELECT 
	COUNT(download_md5_hash), 
	download_md5_hash,
	av_result
FROM 
	downloads 
	LEFT OUTER JOIN avs ON (av_vendor = 'Kaspersky' AND av_md5_hash = download_md5_hash) 
WHERE
	av_result IS NULL
GROUP BY 
	download_md5_hash 
ORDER BY 
	COUNT(download_md5_hash) DESC
	LIMIT 10

So, files where we had 1382 successful downloads during a week are unknown to virustotal, definitely no single broken samples. I had to limit the query to the first 10, as the whole list of 1624 samples does not provide any new value.

If virustotal has the file, but a av vendor does not detect it, we call it a blind spot.

SELECT 
	COUNT(av_vendor),
	av_vendor
FROM 
	(SELECT DISTINCT download_md5_hash  FROM downloads)
	JOIN avs AS o ON (o.av_md5_hash = download_md5_hash)  
WHERE
	o.av_result = '-'
GROUP BY 
	o.av_vendor
ORDER BY 
	COUNT(av_vendor) DESC

Given the fact we have only about 400 results from virustotal, 192 blind spots mean your av solution would detect 50% (!) from the malware the honeypot gatherd from the wild in a single week.

Next point, how many blind spots has specific virus scanner, I choose Kaspersky as 4 blind spots is a good value to query, goind for 1 or 192 blind spots is pointless.

SELECT 
	COUNT(download_md5_hash), 
	download_md5_hash,
	av_result
FROM 
	downloads 
	LEFT OUTER JOIN avs ON (av_vendor = 'Kaspersky' AND av_md5_hash = download_md5_hash) 
WHERE
	av_result = '-' 
GROUP BY 
	download_md5_hash 
ORDER BY 
	COUNT(download_md5_hash) DESC

From the 400 files virustotal knew, there are 4 where Kasperky did not provide a signature, maybe other av vendors got a name on it?

SELECT 
	download_md5_hash,
	o.av_vendor,
	o.av_result
FROM 
	downloads 
	JOIN avs AS k ON (k.av_vendor = 'Kaspersky' AND k.av_md5_hash = download_md5_hash)  
	JOIN avs AS o ON (o.av_md5_hash = download_md5_hash)  
WHERE
	k.av_result = '-' AND o.av_result != '-'
GROUP BY 
	download_md5_hash, o.av_vendor

Yes, some recognize the files Kaspersky does not, and as usual there are multiple names.

Seems like I'll have to extend the script to upload unknown files to virustotal. The plan is to offer the new 'avs' table as mission pack to the paris database, and publish the virustotal script.