Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures

Abstract

Malicious Web activities continue to be a major threat to the safety of online Web users. Despite the plethora forms of attacks and the diversity of their delivery channels, in the back end, they are all orchestrated through malicious Web infrastructures, which enable miscreants to do business with each other and utilize others' resources. Identifying the linchpins of the dark infrastructures and distinguishing those valuable to the adversaries from those disposable are critical for gaining an upper hand in the battle against them.In this paper, using nearly 4 million malicious URL paths crawled from different attack channels, we perform a largescale study on the topological relations among hosts in the malicious Web infrastructure. Our study reveals the existence of a set of topologically dedicated malicious hosts that play orchestrating roles in malicious activities. They are well connected to other malicious hosts and do not receive traffic from legitimate sites. Motivated by their distinctive features in topology, we develop a graph-based approach that relies on a small set of known malicious hosts as seeds to detect dedicate malicious hosts in a large scale. Our method is general across the use of different types of seed data, and results in an expansion rate of over 12 times in detection with a low false detection rate of 2%. Many of the detected hosts operate as redirectors, in particular Traffic Distribution Systems (TDSes) that are long-lived and receive traffic from new attack campaigns over time. These TDSes play critical roles in managing malicious traffic flows. Detecting and taking down these dedicated malicious hosts can therefore have more impact on the malicious Web infrastructures than aiming at short-lived doorways or exploit sites.

DomainProfiler: toward accurate and early discovery of domain names abused in future

“…1-20) had more contributions and higher GI scores than both rIP features (Nos. [21][22][23][24][25][26][27][28][29][30][31][32][33][34][35][36][37][38] 4.1 did not contain such easy-toanswer domain names. As a result, the importance of these TVP features using Alexa1k and Alexa10k is relatively low.…”

“…One reason is parking services. A parking domain name is mainly used for displaying advertisements [4,26,45]. Domain names abused in cyber-attacks tend to use such parking services later to monetize the malicious traffic from malware-infected hosts [26].…”

“…A parking domain name is mainly used for displaying advertisements [4,26,45]. Domain names abused in cyber-attacks tend to use such parking services later to monetize the malicious traffic from malware-infected hosts [26]. We detected such parking domain names in our dataset by following the method proposed by Vissers et al [45].…”

Illuminati: Towards Explaining Graph Neural Networks for Cybersecurity Analysis

“…Graph is a structured data representation with nodes and edges, where nodes denote the entities and edges denote the relationship between them. Graph has been widely used in cybersecurity applications, such as code property graph for code vulnerability detection [1], APIcall graph for Android malware detection [2], and website network for malicious website detection [3].…”

Understanding and mitigating the security risks of content inclusion in web browsers

“…However, the inherent feature of content-sharing on the Web is also an Achilles heel when it comes to security. Advertising networks, as one example, have emerged as an important vector for adversaries to distribute attacks to a wide audience [71,72,92,114,130]. Moreover, users are more susceptible to malvertising in the presence of ad injection [54,117,127].…”