Systems and methods for detecting selective malware attacks

1. A computer-implemented method for detecting selective malware attacks, the method comprising:

identifying a website visited by a first device operating at a first location, wherein a number of visits to the website satisfies a predetermined threshold;

identifying a low prevalence file based on a web crawl of the identified website performed by the first device at the first location, wherein the low prevalence file comprises a file unclassified by a predetermined server;

determining whether a web crawl of the identified website performed by the predetermined server results in the predetermined server detecting the low prevalence file;

determining whether a web crawl of the identified website performed by a second device operating at a second location results in the second device detecting the low prevalence file;

analyzing, by at least one of the first device, second device, and the predetermined server, results of the web crawls to determine whether the identified website distributes a malicious software attack designed to selectively attack visitors to the website; and

upon determining the low prevalence file is detected by the second device and not detected by the predetermined server, generating a notification comprising an alert that the identified website is suspected of distributing a malicious software attack designed to target the first device.

2. The method of claim 1 , further comprising:

upon determining the low prevalence file is identified by the predetermined server, reducing a reputation of the identified website.

3. The method of claim 1 , further comprising:

upon determining the low prevalence file is detected by the first device, generating a request for the second device, the predetermined server, or both, to perform a web crawl of the identified website.

4. The method of claim 1 , further comprising:

executing on-premises software in conjunction with the first device, the first device being connected to an internet gateway at the first location.

5. The method of claim 1 , further comprising:

performing a virus scan on the low prevalence file to determine whether the low prevalence file is malicious.

6. A computing device configured to detect selective malware attacks, comprising:

a processor;

memory in electronic communication with the processor;

instructions stored in the memory, the instructions being executable by the processor to:

identify a website visited by a first device operating at a first location, wherein a number of visits to the website satisfies a predetermined threshold;

identify a low prevalence file based on a web crawl of the identified website performed by the first device at the first location, wherein the low prevalence file comprises a file unclassified by a predetermined server;

determine whether a web crawl of the identified website performed by the predetermined server results in the predetermined server detecting the low prevalence file;

determine whether a web crawl of the identified website performed by a second device operating at a second location results in the second device detecting the low prevalence file;

analyze, by at least one of the first device, second device, and the predetermined server, results of the web crawls to determine whether the identified website distributes a malicious software attack designed to selectively attack visitors to the website; and

upon determining the low prevalence file is detected by the second device and not detected by the predetermined server, generate a notification comprising an alert that the identified website is suspected of distributing a malicious software attack designed to target the first device.

7. The computing device of claim 6 , wherein the instructions are executable by the processor to:

upon determining the low prevalence file is identified by the predetermined server, reduce a reputation of the identified website.

8. The computing device of claim 6 , wherein the instructions are executable by the processor to:

upon determining the low prevalence file is detected by the first device, generate a request for the second device, the predetermined server, or both, to perform a web crawl of the identified website.

9. The computing device of claim 6 , wherein the instructions are executable by the processor to:

execute on-premises software in conjunction with the first device, the first device being connected to an internet gateway at the first location.

10. The computing device of claim 6 , wherein the instructions are executable by the processor to:

perform a virus scan on the low prevalence file to determine whether the low prevalence file is malicious.

11. A computer-program product for detecting, by a processor, selective malware attacks, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by the processor to:

identify a website visited by a first device operating at a first location, wherein a number of visits to the website satisfies a predetermined threshold;

identify a low prevalence file based on a web crawl of the identified website performed by the first device at the first location, wherein the low prevalence file comprises a file unclassified by a predetermined server;

determine whether a web crawl of the identified website performed by the predetermined server results in the predetermined server detecting the low prevalence file;

determine whether a web crawl of the identified website performed by a second device operating at a second location results in the second device detecting the low prevalence file;

analyze, by at least one of the first device, second device, and the predetermined server, results of the web crawls to determine whether the identified website distributes a malicious software attack designed to selectively attack visitors to the website;

upon determining the low prevalence file is detected by the second device and not detected by the predetermined server, generate a notification comprising an alert that the identified website is suspected of distributing a malicious software attack designed to target the first device.