What's clicking what? techniques and innovations of today's clickbots

Authors:
Brad Miller;Paul Pearce;Chris Grier;Christian Kreibich;Vern Paxson
Affiliations:
Computer Science Division, University of California Berkeley;Computer Science Division, University of California Berkeley;Computer Science Division, University of California Berkeley and International Computer Science Institute;International Computer Science Institute;Computer Science Division, University of California Berkeley and International Computer Science Institute
Venue:
DIMVA'11 Proceedings of the 8th international conference on Detection of intrusions and malware, and vulnerability assessment
Year:
2011

Citing 17
Cited 9

The click modular router

ACM Transactions on Computer Systems (TOCS)
A multifaceted approach to understanding the botnet phenomenon

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Tor: the second-generation onion router

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
A case study of the rustock rootkit and spam bot

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
The anatomy of Clickbot.A

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
Combating click fraud via premium clicks

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
Ghost turns zombie: exploring the life cycle of web-based malware

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
A large-scale study of automated web search traffic

AIRWeb '08 Proceedings of the 4th international workshop on Adversarial information retrieval on the web
Studying spamming botnets using Botlab

NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
Not-a-Bot: improving service availability in the face of botnet attacks

NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
Dispatcher: enabling active botnet infiltration using automatic protocol reverse-engineering

Proceedings of the 16th ACM conference on Computer and communications security
SBotMiner: large scale search bot detection

Proceedings of the third ACM international conference on Web search and data mining
Large-scale bot detection for search engines

Proceedings of the 19th international conference on World wide web
The Economics of Click Fraud

IEEE Security and Privacy
Insights from the inside: a view of botnet management from infiltration

LEET'10 Proceedings of the 3rd USENIX conference on Large-scale exploits and emergent threats: botnets, spyware, worms, and more
Measuring pay-per-install: the commoditization of malware distribution

SEC'11 Proceedings of the 20th USENIX conference on Security

A survey of mobile malware in the wild

Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices
GQ: practical containment for measuring modern malware systems

Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference
Measuring and fingerprinting click-spam in ad networks

Proceedings of the ACM SIGCOMM 2012 conference on Applications, technologies, architectures, and protocols for computer communication
Measuring and fingerprinting click-spam in ad networks

ACM SIGCOMM Computer Communication Review - Special october issue SIGCOMM '12
Knowing your enemy: understanding and detecting malicious web advertising

Proceedings of the 2012 ACM conference on Computer and communications security
Manufacturing compromise: the emergence of exploit-as-a-service

Proceedings of the 2012 ACM conference on Computer and communications security
Dissecting ghost clicks: ad fraud via misdirected human clicks

Proceedings of the 28th Annual Computer Security Applications Conference
ViceROI: catching click-spam in search ad networks

Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
DECAF: detecting and characterizing ad fraud in mobile apps

NSDI'14 Proceedings of the 11th USENIX Conference on Networked Systems Design and Implementation

Quantified Score

Hi-index	0.00

Visualization

Abstract

With the widespread adoption of Internet advertising, fraud has become a systemic problem.While the existence of clickbots--malware specialized for conducting click-fraud--has been known for a number of years, the actual functioning of these programs has seen little study. We examine the operation and underlying economic models of two families of modern clickbots, "Fiesta" and "7cy." By operating the malware specimens in a controlled environment we reverse-engineered the protocols used to direct the clickbots in their activities.We then devised a milker program that mimics clickbots requesting instructions, enabling us to extract over 360,000 click-fraud directives from the clickbots' control servers. We report on the functioning of the clickbots, the steps they employ to evade detection, variations in how their masters operate them depending on their geographic locality, and the differing economic models underlying their activity.