Shady paths: leveraging surfing crowds to detect malicious web pages

  • Authors:

  • Gianluca Stringhini;Christopher Kruegel;Giovanni Vigna

  • Affiliations:

  • University of California, Santa Barbara, Santa Barbara, California, USA;University of California, Santa Barbara, Santa Barbara, California, USA;University of California, Santa Barbara, Santa Barbara, California, USA

  • Venue:
  • Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

The web is one of the most popular vectors to spread malware. Attackers lure victims to visit compromised web pages or entice them to click on malicious links. These victims are redirected to sites that exploit their browsers or trick them into installing malicious software using social engineering. In this paper, we tackle the problem of detecting malicious web pages from a novel angle. Instead of looking at particular features of a (malicious) web page, we analyze how a large and diverse set of web browsers reach these pages. That is, we use the browsers of a collection of web users to record their interactions with websites, as well as the redirections they go through to reach their final destinations. We then aggregate the different redirection chains that lead to a specific web page and analyze the characteristics of the resulting redirection graph. As we will show, these characteristics can be used to detect malicious pages. We argue that our approach is less prone to evasion than previous systems, allows us to also detect scam pages that rely on social engineering rather than only those that exploit browser vulnerabilities, and can be implemented efficiently. We developed a system, called SpiderWeb, which implements our proposed approach. We show that this system works well in detecting web pages that deliver malware.