Evasive Malicious Website Detection by Leveraging Redirection Subgraph Similarities

Toshiki SHIBAHARA  Yuta TAKATA  Mitsuaki AKIYAMA  Takeshi YAGI  Kunio HATO  Masayuki MURATA  

IEICE TRANSACTIONS on Information and Systems   Vol.E102-D   No.3   pp.430-443
Publication Date: 2019/03/01
Publicized: 2018/10/30
Online ISSN: 1745-1361
DOI: 10.1587/transinf.2018FCP0007
Type of Manuscript: Special Section PAPER (Special Section on Foundations of Computer Science — Algorithm, Theory of Computation, and their Applications —)
drive-by download attack,  browser fingerprinting,  graph mining,  clustering,  

Full Text: PDF(1.4MB)>>
Buy this Article

Many users are exposed to threats of drive-by download attacks through the Web. Attackers compromise vulnerable websites discovered by search engines and redirect clients to malicious websites created with exploit kits. Security researchers and vendors have tried to prevent the attacks by detecting malicious data, i.e., malicious URLs, web content, and redirections. However, attackers conceal parts of malicious data with evasion techniques to circumvent detection systems. In this paper, we propose a system for detecting malicious websites without collecting all malicious data. Even if we cannot observe parts of malicious data, we can always observe compromised websites. Since vulnerable websites are discovered by search engines, compromised websites have similar traits. Therefore, we built a classifier by leveraging not only malicious but also compromised websites. More precisely, we convert all websites observed at the time of access into a redirection graph and classify it by integrating similarities between its subgraphs and redirection subgraphs shared across malicious, benign, and compromised websites. As a result of evaluating our system with crawling data of 455,860 websites, we found that the system achieved a 91.7% true positive rate for malicious websites containing exploit URLs at a low false positive rate of 0.1%. Moreover, it detected 143 more evasive malicious websites than the conventional content-based system.