ASwatch

Abstract

Bulletproof hosting Autonomous Systems (ASes)-malicious ASes fully dedicated to supporting cybercrime-provide freedom and resources for a cyber-criminal to operate. Their services include hosting a wide range of illegal content, botnet C&C servers, and other malicious resources. Thousands of new ASes are registered every year, many of which are often used exclusively to facilitate cybercrime. A natural approach to squelching bulletproof hosting ASes is to develop a reputation system that can identify them for takedown by law enforcement and as input to other attack detection systems (e.g., spam filters, botnet detection systems). Unfortunately, current AS reputation systems rely primarily on data-plane monitoring of malicious activity from IP addresses (and thus can only detect malicious ASes after attacks are underway), and are not able to distinguish between malicious and legitimate but abused ASes.

Rotten Apples or Bad Harvest? What We Are Measuring When We Are Measuring Abuse

“…Quite the contrary: data-driven policy could try to improve the factors identified as influential, e. g., require higher security standards at providers who host more popular websites. Furthermore, relative abuse metrics can, in themselves, incentivize better security [Konte et al 2015;He et al 2015]. In sum: throwing out a few rotten apples might appear more tractable, but producing a better harvest is definitely possible.…”

“…Defender properties are then branched to two main groups: structural and security effort related properties. Relevant structural properties of defender include the size of the provider, as recognized in earlier work [Clayton et al 2015;Noroozian et al 2015;Stone-Gross et al 2009;Konte et al 2015]. Simply put, the more domains or IP addresses a provider hosts, the higher the odds of incurring an abuse incident, as there is a larger number of potential victims in the network.…”

“…Another strand of work looks at how abuse is distributed across aggregate units of resources, such as address blocks, Autonomous Systems (ASes) Noroozian et al 2015] or top-level domains (TLDs) [Aaron and Rasmussen 2015a]. These studies often identify concentrations of abuse in certain networks [Ramachandran and Feamster 2006;Collins et al 2007;] and then identify network features that correlate with abuse rates, such as poor network hygiene [Zhang et al 2014;Stone-Gross et al 2009] or rapidly changing network connectivity [Shue et al 2012;Wagner et al 2013;Konte et al 2015]. These studies aim to detect malicious or poorly managed networks, rather than disentangling the factors explaining the causal relationship of why abuse is concentrated there or how it is distributed across all networks.…”

Monitoramento e Identificação de Páginas de Phishing

“…Mecanismos de combate ao phishing podem ser classificados em três frentes: (i) educac ¸ão e treinamento do usuário, instruindo-o a realizar verificac ¸ões simples para reconhecer tentativas de phishing e evitar golpes; (ii) mecanismos que identificam mensagens de e-mail de phishing, filtrando ou marcando o e-mail antes que o usuário seja exposto ao conteúdo da mensagem; e (iii) mecanismos de combate às páginas de phishing [Gupta et al 2017, Mason 2002, identificando e desativando servidores que hospedam páginas maliciosas. Mecanismos de identificac ¸ão de mensagens de phishing (frente ii) são frequentemente integrados à interface de e-mail de usuários devido à dificuldade de identificar e desativar servidores que hospedam páginas de phishing, seja devido a questões legais ou redes de hospedagem "à prova de bala"(bulletproof hosting) [Konte et al 2015]. O arcabouc ¸o e análise de classificadores apresentados neste artigo contribuem para o desenvolvimento de novos mecanismos de combate ao phishing.…”