Fine-grained analysis of compromised websites with redirection graphs and JavaScript traces

Yuta Takata, Mitsuaki Akiyama, Takeshi Yagi, Takeshi Yada, Shigeki Goto

    研究成果: Article査読

    3 被引用数 (Scopus)

    抄録

    An incident response organization such as a CSIRT contributes to preventing the spread of malware infection by analyzing compromised websites and sending abuse reports with detected URLs to webmasters. However, these abuse reports with only URLs are not sufficient to clean up the websites. In addition, it is difficult to analyze malicious websites across different client environments because these websites change behavior depending on a client environment. To expedite compromised website clean-up, it is important to provide fine-grained information such as malicious URL relations, the precise position of compromised web content, and the target range of client environments. In this paper, we propose a new method of constructing a redirection graph with context, such as which web content redirects to malicious websites. The proposed method analyzes a website in a multi-client environment to identify which client environment is exposed to threats. We evaluated our system using crawling datasets of approximately 2,000 compromised websites. The result shows that our system successfully identified malicious URL relations and compromised web content, and the number of URLs and the amount of web content to be analyzed were sufficient for incident responders by 15.0% and 0.8%, respectively. Furthermore, it can also identify the target range of client environments in 30.4% of websites and a vulnerability that has been used in malicious websites by leveraging target information. This finegrained analysis by our system would contribute to improving the daily work of incident responders.

    本文言語English
    ページ(範囲)1714-1728
    ページ数15
    ジャーナルIEICE Transactions on Information and Systems
    E100D
    8
    DOI
    出版ステータスPublished - 2017 8月 1

    ASJC Scopus subject areas

    • ソフトウェア
    • ハードウェアとアーキテクチャ
    • コンピュータ ビジョンおよびパターン認識
    • 人工知能
    • 電子工学および電気工学

    フィンガープリント

    「Fine-grained analysis of compromised websites with redirection graphs and JavaScript traces」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

    引用スタイル