Shady paths: Leveraging surfing crowds to detect malicious web pages

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2013, Pages 133-144

  Stringhini, Gianluca ^a   Kruegel, Christopher ^a   Vigna, Giovanni ^a  

^a UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

detection; http redirections; malware

Indexed keywords

MALICIOUS SOFTWARE; MALICIOUS WEB PAGES; MALWARES; SOCIAL ENGINEERING; WEB USERS;

COMPUTER CRIME; ERROR DETECTION; HTTP; SECURITY OF DATA; WEB BROWSERS;

WEBSITES;

EID: 84889042781     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2508859.2516682     Document Type: Conference Paper

References (32)

1. Alexa, the Web Information Company. http://www.alexa.com.
2. M. Cova, C. Kruegel, and G. Vigna. Detection and Analysis of Drive-by-Download Attacks and Malicious JavaScript code. In International Conference on World Wide Web, 2010.
3. C. Curtsinger, B. Livshits, B. Zorn, and C. Seifert. Zozzle: Low-overhead mostly static javascript malware detection. In USENIX Security Symposium, 2011.
4. A. Doupè, B. Boe, C. Kruegel, and G. Vigna. Fear the EAR: discovering and mitigating execution after redirect vulnerabilities. In ACM Conference on Computer and Communications Security (CCS), 2011.
5. Chris Grier, Lucas Ballard, Juan Caballero, Neha Chachra, Christian J. Dietrich, Kirill Levchenko, Panayiotis Mavrommatis, Damon McCoy, Antonio Nappa, Andreas Pitsillidis, et al. Manufacturing compromise: The emergence of exploit-as-a-service. In ACM Conference on Computer and Communications Security (CCS), 2012.
6. Hall, M. and Frank, E. and Holmes, G. and Pfahringer, B. and Reutemann, P. and Witten, I.H. The WEKA Data Mining Software: An Update. In SIGKDD Explorations, 2009.
7. McAfee Inc. Mapping the Mal Web. Technical report, 2010.
8. A. Kapravelos, Y. Shoshitaishvili, M. Cova, C. Kruegel, and G. Vigna. Revolver: An Automated Approach to the Detection of Evasive Web-based Malware. In USENIX Security Symposium, 2013.
9. C. Kolbitsch, B. Livshits, B. Zorn, and C. Seifert. Rozzle: De-Cloaking Internet Malware. In IEEE Symposium on Security and Privacy, 2012.
10. S. Lee and J. Kim. WARNINGBIRD: Detecting Suspicious URLs in Twitter Stream. In Symposium on Network and Distributed System Security (NDSS), 2012.
11. Z. Li, K. Zhang, Y. Xie, F. Yu, and X.F. Wang. Knowing Your Enemy: Understanding and Detecting Malicious Web Advertising. In ACM Conference on Computer and Communications Security (CCS), 2012.
12. H. Liu, K. Levchenko, M. Félegyházi, C. Kreibich, G. Maier, G.M. Voelker, and S. Savage. On the effects of registrarlevel intervention. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2011.
13. L. Lu, R. Perdisci, and W. Lee. SURF: Detecting and Measuring Search Poisoning. In ACM Conference on Computer and Communications Security (CCS), 2011.
14. J. Ma, L.K. Saul, S. Savage, and G.M. Voelker. Beyond Blacklists: Learning to Detect Malicious Web Sites from Suspicious URLs. In ACM SIGKDD international conference on Knowledge discovery and data mining, 2009.
15. J. Nazario. PhoneyC: a Virtual Client Honeypot. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2009.
16. A. Ntoulas, M. Najork, M. Manasse, and D. Fetterly. Detecting Spam Web Pages Through Content Analysis. In International Conference on World Wide Web, 2006.
17. J. Platt et al. Sequential minimal optimization: A fast algorithm for training support vector machines. Technical report, 1998.
18. N. Provos, P. Mavrommatis, M.A. Rajab, and F. Monrose. All Your Iframes Point to Us. In USENIX Security Symposium, 2008.
19. P. Ratanaworabhan, B. Livshits, and B. Zorn. Nozzle: A defense against heap-spraying code injection attacks. In USENIX Security Symposium, 2009.
20. C. Seifert and R. Steenson. Capture-honeypot Client (capture-hpc), 2006.
21. C. Seifert, I. Welch, P. Komisarczuk, et al. Honeyc: the Low-interaction Client Honeypot. Proceedings of the 2007 NZCSRCS, 2007.
22. J.W. Stokes, R. Andersen, C. Seifert, and K. Chellapilla. Webcop: Locating Neighborhoods of Malware on the Web. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2010.
23. B. Stone-Gross, R. Abman, R. Kemmerer, C. Kruegel, D. Steigerwald, and G. Vigna. The Underground Economy of Fake Antivirus Software. In Workshop on the Economics of Information Security (WEIS), 2011.
24. B. Stone-Gross, R. Stevens, A. Zarras, R. Kemmerer, C. Kruegel, and G. Vigna. Understanding fraudulent activities in online ad exchanges. In ACM SIGCOMM Conference on Internet Measurement, 2011.
25. K. Thomas, C. Grier, J. Ma, V. Paxson, and D. Song. Design and Evaluation of a Real-time URL Spam Filtering Service. In IEEE Symposium on Security and Privacy, 2011.
26. T. Urvoy, E. Chauveau, P. Filoche, and T. Lavergne. Tracking Web Spam with HTML Style Similarities. ACM Transactions on the Web (TWEB), 2008.
27. D.Y. Wang, S. Savage, and G.M. Voelker. Cloak and Dagger: Dynamics of Web Search Cloaking. In ACM Conference on Computer and Communications Security (CCS), 2011.
28. Y.M. Wang, D. Beck, X. Jiang, R. Roussev, C. Verbowski, S. Chen, and S. King. Automated Web Patrol with Strider Honeymonkeys. In Symposium on Network and Distributed System Security (NDSS), 2006.
29. Y.M. Wang and M. Ma. Detecting Stealth Web Pages That Use Click-Through Cloaking. Technical report, Microsoft Research Technical Report, MSR-TR-2006-178, 2006.
30. B. Wu and B.D. Davison. Detecting Semantic Cloaking on the Web. In International Conference on World Wide Web, 2006.
31. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov. Spamming Botnets: Signatures and Characteristics. In ACM SIGCOMM Computer Communication Review, 2008.
32. J. Zhang, C. Seifert, J.W. Stokes, and W. Lee. ARROW: Generating Signatures to Detect Drive-By Downloads. In International Conference on World Wide Web, 2011.