evilseed a guided approach to finding malicious web pages
play

EvilSeed : A Guided Approach to Finding Malicious Web Pages L. - PowerPoint PPT Presentation

May 31, 2023 •557 likes •1.05k views

EvilSeed : A Guided Approach to Finding Malicious Web Pages L. Invernizzi 1 S. Benvenuti 2 M. Cova 3 , 5 P. Milani Comparetti 4 , 5 C. Kruegel 1 G. Vigna 1 1 UC Santa Barbara 2 University of Genova 3 University of Birmingham 4 Vienna University of

  1. EvilSeed : A Guided Approach to Finding Malicious Web Pages L. Invernizzi 1 S. Benvenuti 2 M. Cova 3 , 5 P. Milani Comparetti 4 , 5 C. Kruegel 1 G. Vigna 1 1 UC Santa Barbara 2 University of Genova 3 University of Birmingham 4 Vienna University of Technology 5 Lastline, Inc. IEEE Security & Privacy 2012

  2. Finding malicious URLs L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  3. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  4. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  5. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  6. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  7. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  8. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  9. Landing and exploit pages L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  10. Finding malicious URLs L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  11. Finding malicious URLs L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  12. Finding malicious URLs is hard! Wepawet Over 120 thousand URLs analyzed per day by the oracle. Available online: http://wepawet.cs.ucsb.edu The problem 0 , 138% of the URLs reached with a random crawl are malicious L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  13. Our goal Finding malicious URLs efficiently L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  14. What can a malicious URL tell us? L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  15. Gadgets L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  16. EvilSeed L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  17. Links gadget Designed to locate malware hubs Example query: link:http://malicious-url.com L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  18. Links gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  19. Links gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  20. Content Dorks gadget Creates signatures from the content of landing pages. Two methods: n-gram extraction term-extraction (e.g., cnn.com yields: Eurozone recession, gay wedding, Facebook attack, graphic content) L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  21. Content Dorks gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  22. Content Dorks gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  23. Content Dorks gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  24. Content Dorks gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  25. Content Dorks gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  26. SEO gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  27. SEO gadget Expansion strategies: Find pages with similar content as Google sees it (e.g., query for title:"free iphones" ) Find pages hosted on the same domain (e.g., query for site:seo.com ) Follow links L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  28. Domain Registrations gadget We know that: http://a.com/exploit is malicious. a.com has been registered moments before b.com We suspect that: http://b.com/exploit is also malicious L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  29. DNS Queries gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  30. DNS Queries gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  31. DNS Queries gadget L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  32. Evaluation metrics URLs classified as malicious Toxicity = URLs submitted to the Oracle Seed Expansion = malicious URLs found by EvilSeed seed size L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  33. Online evaluation: URLs Source Seed Analyzed Malicious Toxicity Expansion Crawler w/ Prefilter 437,251 604 0.14% EvilSeed Links 604 71,272 1,097 1.53% 1.81 SEO 604 312 16 5.12% 0.02 Keywords 604 13,896 477 3.43% 0.78 Ngrams 604 140,660 1,446 1.02% 2.39 Total 226,140 3,036 1.34% 5.02 Web Search Random Strings 24,137 68 0.28% Random Dictionary 27,242 107 0.39% Trending Topics 8,051 27 0.33% Manual Dorks 4,506 17 0.37% L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  34. Online evaluation: domains Source Seed Analyzed Malicious Toxicity Expansion Crawler w/ Prefilter 53,445 98 0.18% EvilSeed Links 98 7,664 107 1.39% 1.09 SEO 98 7 5 71.42% 0.07 Keywords 98 3,245 119 3.66% 1.22 Ngrams 98 33,510 263 0.78% 2.68 Total 44,426 494 1.12% 5.04 Web Search Random Strings 4,227 16 0.37% Random Dictionary 9,285 35 0.37% Trending Topics 1,768 8 0.45% Manual Dorks 3,032 13 0.42% L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  35. DNS evaluation Data: 377,472,280 DNS resolutions 115 malicious seeds Resulting in 3.5% toxicity, 1.48 seed expansion L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  36. EvilSeed for Search Engines L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  37. EvilSeed for Search Engines L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  38. EvilSeed for Search Engines L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  39. EvilSeed for Search Engines L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  40. EvilSeed for Search Engines L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  41. Conclusions Finding malicious urls is important to protect the users L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  42. Conclusions Finding malicious urls is important to protect the users, but it’s hard L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  43. Conclusions Finding malicious urls is important to protect the users, but it’s hard It’s critical to generate feeds with high toxicity ( ⇒ high efficiency) L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  44. Conclusions Finding malicious urls is important to protect the users, but it’s hard It’s critical to generate feeds with high toxicity ( ⇒ high efficiency) We designed EvilSeed , a guided search approach that is a ten-fold efficency improvement over crawling L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

  45. Conclusions Finding malicious urls is important to protect the users, but it’s hard It’s critical to generate feeds with high toxicity ( ⇒ high efficiency) We designed EvilSeed , a guided search approach that is a ten-fold efficency improvement over crawling But crawling is needed nontheless, to generate the evil seed L. Invernizzi, S. Benvenuti, M. Cova, P. Milani Comparetti, C. Kruegel, G. Vigna EvilSeed : http://bit.ly/evilseed

Recommend

Guided Pathways 101 The Guided Pathways framework creates a highly structured approach to student

Guided Pathways 101 The Guided Pathways framework creates a highly structured approach to student

Guided Pathways 101 The Guided Pathways framework creates a highly structured approach to student success that: Provides all students Integrates support services in ways with a set of clear course-taking that make it easier for students to get

525 views • 11 slides
WEBCOP: LOCATING NEIGHBORHOODS OF MALWARE ON THE WEB Reid Andersen Jay Stokes

WEBCOP: LOCATING NEIGHBORHOODS OF MALWARE ON THE WEB Reid Andersen Jay Stokes

WEBCOP: LOCATING NEIGHBORHOODS OF MALWARE ON THE WEB Reid Andersen Jay Stokes Christian Seifert Microsoft Research Kumar Chellapilla Microsoft Search Detecting Malicious Web Pages Detecting Malicious Web Pages Production

427 views • 23 slides
1 Heuristic (Bound- -Guided) Search Guided) Search Bucket Tree Heuristic (Bound Bucket Tree

1 Heuristic (Bound- -Guided) Search Guided) Search Bucket Tree Heuristic (Bound Bucket Tree

Finding Leading Solutions Leading Solutions Finding Many AI problems = Constraint optimization problems On- -demand Bound Computation demand Bound Computation On Diagnosis (state estimation) for Finding Leading Solutions for Finding

266 views • 8 slides
ParmeSan: Sanitizer-guided Greybox Fuzzing USENIX 2020 *some pages borrowed from Zheyu Ma

ParmeSan: Sanitizer-guided Greybox Fuzzing USENIX 2020 *some pages borrowed from Zheyu Ma

ParmeSan: Sanitizer-guided Greybox Fuzzing USENIX 2020 *some pages borrowed from Zheyu Ma background What is fuzzing: feed random inputs to trigger as many crashes and hangs as possible What is state-of-the-art of fuzzing research:

494 views • 18 slides
BIOINFORMATICS Pages 873879 SST: an algorithm for finding near-exact sequence matches in time

BIOINFORMATICS Pages 873879 SST: an algorithm for finding near-exact sequence matches in time

Vol. 18 no. 6 2002 BIOINFORMATICS Pages 873879 SST: an algorithm for finding near-exact sequence matches in time proportional to the logarithm of the database size Eldar Giladi 1, , Michael G. Walker 1 , James Z. Wang 2 and Wayne

333 views • 7 slides
Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 23 March 2006 What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, Code that breaks your security policy.

707 views • 69 slides
Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 10 March 2005 What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, Code that breaks your security policy.

1.16k views • 94 slides
RVFuzzer: Finding Input Validation Bugs in Robotic Vehicles through Control-Guided Testing Taegyu

RVFuzzer: Finding Input Validation Bugs in Robotic Vehicles through Control-Guided Testing Taegyu

RVFuzzer: Finding Input Validation Bugs in Robotic Vehicles through Control-Guided Testing Taegyu Kim , Chung Hwan Kim, Junghwan Rhee, Fan Fei, Zhan Tu, Gregory Walkup, Xiangyu Zhang, Xinyan Deng, Dongyan Xu Robotic Vehicles? How Do Robotic

354 views • 17 slides
NeuStar Registry Services approach to Malicious Activity ICANN London Consultation Jeffrey J.

NeuStar Registry Services approach to Malicious Activity ICANN London Consultation Jeffrey J.

NeuStar Registry Services approach to Malicious Activity ICANN London Consultation Jeffrey J. Neuman VP, Law and Policy July 15, 2009 WHY DID NEUSTAR GET INVOLVED IN 2006? Feedback / avoid dangerous domain blacklist Internal

396 views • 13 slides
FFR Guided Functional FFR Guided Functional FFR Guided Functional FFR Guided Functional

FFR Guided Functional FFR Guided Functional FFR Guided Functional FFR Guided Functional

FFR Guided Functional FFR Guided Functional FFR Guided Functional FFR Guided Functional Angioplasty Angioplasty g g p p y y in Complex Anatomy in Complex Anatomy Jung-Min Ahn, MD g , Heart Institute Asan Medical Center Heart

671 views • 27 slides
MVC Guided Pathways Brief review of Guided Pathways at MVC Plan for Today Spring

MVC Guided Pathways Brief review of Guided Pathways at MVC Plan for Today Spring

MVC Guided Pathways Brief review of Guided Pathways at MVC Plan for Today Spring 2018-Summer 2019 Action Plan and Budget Guided Pathways in California A Framework for Improving Completion Multiple Guided Pathways Initiatives

407 views • 13 slides
A New Approach to Ultrasound Guided Radio-Frequency Needle Placement Claudio Alcrreca, Jakob

A New Approach to Ultrasound Guided Radio-Frequency Needle Placement Claudio Alcrreca, Jakob

Chair for Computer Aided Medical Procedures & Augmented Reality | wwwnavab.cs.tum.edu A New Approach to Ultrasound Guided Radio-Frequency Needle Placement Claudio Alcrreca, Jakob Vogel , Marco Feuerstein, and Nassir Navab March 26,

342 views • 19 slides
Differentiation Math Instruction through a Centers/Guided Math Approach Debbie Leslie and Denise

Differentiation Math Instruction through a Centers/Guided Math Approach Debbie Leslie and Denise

Differentiation Math Instruction through a Centers/Guided Math Approach Debbie Leslie and Denise Porter Center for Elementary Mathematics and Science Education University of Chicago Just s so y you kno know We will use content examples

357 views • 24 slides
Catford Bridge Rugby Football Club Memorial Pages 1 Index Introduction - page 3 Finding the

Catford Bridge Rugby Football Club Memorial Pages 1 Index Introduction - page 3 Finding the

Catford Bridge Rugby Football Club Memorial Pages 1 Index Introduction - page 3 Finding the records of the fallen - page 4 Enlisting in the army joining the great fight page 7 Recognitions and awards of the Great War - 12 Index to the

425 views • 42 slides
Finding ECM friendly curves: A Galois approach Sudarshan SHINDE Sorbonne Universit es, Paris

Finding ECM friendly curves: A Galois approach Sudarshan SHINDE Sorbonne Universit es, Paris

Computer algebra Approach Modular curves approach Comparing different families Finding ECM friendly curves: A Galois approach Sudarshan SHINDE Sorbonne Universit es, Paris (UPMC, IMJ-PRG) 25/01/2018 1 / 24 Computer algebra Approach

547 views • 36 slides
faster c&c detection - strategies for finding algorithmically generated domain names

faster c&c detection - strategies for finding algorithmically generated domain names

. Malgorzata Debska September 22, 2015 CERT Polska faster c&c detection - strategies for finding algorithmically generated domain names Introduction - what is DGA? Malicious usage in botnets Benign DGA - false alarms in detection

1.38k views • 99 slides
Finding the needs of customer by the SN Matrix and TRIZ process - The functional approach for

Finding the needs of customer by the SN Matrix and TRIZ process - The functional approach for

Finding the needs of customer by the SN Matrix and TRIZ process - The functional approach for connecting methods and 7 solutions- September 11, 2014 Takashi Ogata, Kazuhiro Fujikawa, Hiroyuki Tsuchiya ECM Promotion Department Monozukuri

475 views • 23 slides
Malicious Software Countermeasures Summary ITS335: IT Security Sirindhorn International

Malicious Software Countermeasures Summary ITS335: IT Security Sirindhorn International

ITS335 Malicious Software Malicious Software Propagation Payload Malicious Software Countermeasures Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October

673 views • 30 slides
Outlines Weighted Graph Cuts without Eigenvectors: A Multilevel Approach (PAMI 2007) User-Guided

Outlines Weighted Graph Cuts without Eigenvectors: A Multilevel Approach (PAMI 2007) User-Guided

Outlines Weighted Graph Cuts without Eigenvectors: A Multilevel Approach (PAMI 2007) User-Guided Large Attributed Graph Clustering with Multiple Sparse Annotations (PAKDD 2016) Problem Definition Clustering nonlinearly separable data: Kernel

689 views • 38 slides
Finding your way in a graph Finding your way in a graph Finding your way in a graph Finding your

Finding your way in a graph Finding your way in a graph Finding your way in a graph Finding your

Finding your way in a graph Finding your way in a graph Finding your way in a graph Finding your way in a graph = station One loop = junction A system of interconnected loops L L What is the best way to go from L to ? L L L 1 ? L

2.13k views • 166 slides
A Bayesian Approach to Finding Compact Representations for Reinforcement Learning Special thanks

A Bayesian Approach to Finding Compact Representations for Reinforcement Learning Special thanks

A Bayesian Approach to Finding Compact Representations for Reinforcement Learning Special thanks to Joelle Pineau for presenting our paper - July, 2012 1 Authors Alborz Geramifard Stefanie Tellex David Wingate Nicholas Roy Jonathan How 2

491 views • 25 slides
Year 3 Guided Pathways Plan Presentation Presented by: Palomar Guided Pathways Team DATE: May

Year 3 Guided Pathways Plan Presentation Presented by: Palomar Guided Pathways Team DATE: May

Year 3 Guided Pathways Plan Presentation Presented by: Palomar Guided Pathways Team DATE: May 15, 2020 Presenters: Glyn Bongolan, Alex Cuatok, Kelly Falcone, Katy Farrell, Wendy Nelson And our Guided Pathways Ambassadors Focus for Today:

656 views • 50 slides
Finding the Hidden Bequests in Your Database presented by Jonathan Wright, Wright Approach

Finding the Hidden Bequests in Your Database presented by Jonathan Wright, Wright Approach

Finding the Hidden Bequests in Your Database presented by Jonathan Wright, Wright Approach Marketing Paul Evans, Gifts in Wills Manager, World Vision Australia November 2018 96-Year-Old Secretary Quietly Amasses Fortune, Then Donates $8.2

377 views • 27 slides
A Graph Modification Approach for Finding CorePeriphery Structures in Protein Interaction

A Graph Modification Approach for Finding CorePeriphery Structures in Protein Interaction

A Graph Modification Approach for Finding CorePeriphery Structures in Protein Interaction Networks Sharon Bruckner 1 uffner 2 Christian Komusiewicz 2 Falk H 1 Institut f ur Mathematik, Freie Universit at Berlin 2 Institut f ur

397 views • 25 slides

More recommend