NOMAD: Towards non-intrusive moving-target defense against web bots

2013 IEEE Conference on Communications and Network Security, CNS 2013

Volumn , Issue , 2013, Pages 55-63

  Vikram, Shardul ^a   Yang, Chao ^a   Gu, Guofei ^a  

^a TEXAS A AND M UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

HTML; NETWORK SECURITY;

CAPTCHAS; DEFENSE SYSTEM; LOW OVERHEAD; MOVING TARGETS; NON-INTRUSIVE; OPEN SOURCES; WEB RESOURCES;

HTTP;

EID: 84893633536     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CNS.2013.6682692     Document Type: Conference Paper

References (44)

1. Buddypress - social networking in a box. http://buddypress.org/.
2. Esp-pix. http://server251.theory.cs.cmu.edu/cgi-bin/esp-pix/esp-pix.
3. Flooded by spam/splog registrations. http://wordpress.org/support/topic/.
4. Gimpy project. http://www.captcha.net/captchas/gimpy/.
5. Lori: Life-of-request info. https://addons.mozilla.org/en-US/firefox/ addon/lori-life-of-request-info/.
6. Magic submitter. http://www.magicsubmitter.com/.
7. Pcre. http://www.pcre.org/.
8. Poll bots. http://www.scriptlance.com/projects/1290407615.shtml.
9. Privoxy. http://www.privoxy.org/.
10. recaptcha. http://www.google.com/reCAPTCHA.
11. Spam injection. http://www.web-form-buddy.com/html-wfb/spam-injection. html.
12. Spam swine break next-gen captchas. http://www.theregister.co.uk/2008/10/ 03/captcha break/.
13. The spambots on twitter are completely out of control. http://wilwheaton.typepad.com/wwdnbackup/2009/08/the-spambots-on-twitter-are- completely-out-of-control.html.
14. Sq-pix. http://server251.theory.cs.cmu.edu/cgi-bin/sq-pix.
15. Top powered by wordpress sites. http://www.tripwiremagazine.com/2009/11/ 20-remarkable-examples-of-websites-powered-by-wordpress.html.
16. Web form spam alive and kicking. http://blog.trendmicro.com/web-form- spam-alive-and-kicking/.
17. Wordpress - wordpress is web software you can use to create a beautiful website or blog. http://wordpress.org/.
18. Wordpress powers 14.7 percent of world's sites. http://www.h-online.com/ open/news/item/.
19. Xrumer. http://www.botmasterlabs.net/.
20. Web bots vs humans: We're losing. http://www.sitepoint.com/web-bots-vs- humans/, 2012.
21. L. Ahn, M. Blum, N. Hopper, and J. Langford. Captcha: Using hard ai problems for security. In In In In Proceedings of Eurocrypt, 2003.
22. L. Ahn, M. Blum, and J. Langford. Telling humans and computers apart automatically. Commun. ACM.
23. H. Baird and K. Popat. Human interactive proofs and document image analysis. In Proceedings of the 5th International Workshop on Document Analysis Systems V, DAS '02.
24. A. Bhattarai, V. Rus, and D. Dasgupta. Characterizing comment spam in the blogosphere through content analysis. In IEEE Symposium on Computational Intelligence in Cyber Security, (CICS'09).
25. D. Brewer, K. Li, L. Ramaswamy, and C. Pu. A link obfuscation service to detect webbots. International Conference on Services Computing, 2010.
26. K. Chellapilla, K. Larson, P. Simard, and M. Czerwinski. Designing human friendly human interaction proofs (hips). In Proceedings of the SIGCHI conference on Human factors in computing systems, CHI '05.
27. M. Chew and J. Tygar. Image recognition captchas. In In Proceedings of the 7th International Information Security Conference (ISC'04).
28. R. Datta, J. Li, and J. Wang. Imagination: a robust image-based captcha generation system. In Proceedings of the 13th annual ACM international conference on Multimedia (MULTIMEDIA '05).
29. J. Elson, J. Doucerur, J. Howell, and J. Saul. Asirra: A captcha that exploits interest-aligned manual image categorization. In Proceedings of the 14th ACM CCS, 2007.
30. S. Gianvecchio, Zhenyu Wu Mengjun Xie, and Haining Wang. Detecting Blog Bots through Behavioral Biometrics. 2013.
31. S. Gianvecchio, M. Xie, Z. Wu, and H. Wang. Measurement and Classification of Humans and Bots in Internet Chat. In USENIX Security Symposium, 2008.
32. Steven Gianvecchio, Z. Wu, M. Xie, and H. Wang. Battle of Botcraft: Fighting Bots in Online Games with Human Observational Proofs. In USENIX Security Symposium, 2008.
33. R. Gossweiler, M. Kamvar, and S. Baluja. What's up captcha?: a captcha based on image orientation. In Proceedings of the 18th international conference on World wide web (WWW'09).
34. M. V. Gundy and H. Chen. Noncespaces: using randomization to enforce information tracking and thwart crosssite scripting attacks. In 16th Annual Network and Distributed System Security Symposium, 2009.
35. P. Matthews and C. Zou. Scene tagging: image-based captcha using image composition and object relationships. In Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, ASIACCS '10.
36. G. Mishne. Blocking blog spam with language model disagreement. In In Proceedings of the First International Workshop on Adversarial Information Retrieval on the Web (AIRWeb'05).
37. Y. Niu, Y. Wang, H. Chen, M. Ma, and F. Hsu. A quantitative study of forum spamming using contextbased analysis. In In Proc. Network and Distributed System Security Symposium (NDSS'07).
38. Y. Rui and Z. Liu. Excuse but are you human? In 11th ACM international conference on Multimedia, 2003.
39. T. Schluessler, S. Goglin, and E. Johnson. Is a bot at the controls? detecting input data attacks. In Proceedings of the 6th ACM SIGCOMM workshop on Network and system support for games (NetGames '07).
40. Y. Shin, M. Gupta, and S. Myers. The nuts and bolts of a forum spam automator. In Proceedings of the 4th USENIX conference on Large-scale exploits and emergent threats, LEET'11.
41. Y. Shin, M. Gupta, and S. Myers. Prevalence and mitigation of forum spamming. In 2011 Proceedings of IEEE INFOCOM.
42. S. Webb. Characterizing web spam using content and http session analysis. In 4th Conference on Email and Anti-Spam (CEAS'07).
43. J. Yan, E. Ahmad, and A. Salah. A low-cost attack on a microsoft captcha. In Proceedings of the 15th ACM conference on Computer and communications security (CCS'08).
44. J. Yan, E. Ahmad, and A. Salah. Usability of captchas or usability issues in captcha design. In Proceedings of the 4th symposium on Usable privacy and security (SOUPS'08).