Evasive Malicious Website Detection by Leveraging Redirection Subgraph Similarities

Abstract

Many users are exposed to threats of drive-by download attacks through the Web. Attackers compromise vulnerable websites discovered by search engines and redirect clients to malicious websites created with exploit kits. Security researchers and vendors have tried to prevent the attacks by detecting malicious data, i.e., malicious URLs, web content, and redirections. However, attackers conceal parts of malicious data with evasion techniques to circumvent detection systems. In this paper, we propose a system for detecting malicious websites without collecting all malicious data. Even if we cannot observe parts of malicious data, we can always observe compromised websites. Since vulnerable websites are discovered by search engines, compromised websites have similar traits. Therefore, we built a classifier by leveraging not only malicious but also compromised websites. More precisely, we convert all websites observed at the time of access into a redirection graph and classify it by integrating similarities between its subgraphs and redirection subgraphs shared across malicious, benign, and compromised websites. As a result of evaluating our system with crawling data of 455,860 websites, we found that the system achieved a 91.7% true positive rate for malicious websites containing exploit URLs at a low false positive rate of 0.1%. Moreover, it detected 143 more evasive malicious websites than the conventional content-based system. key words: drive-by download attack, browser fingerprinting, graph mining, clustering

LSTM RNN: detecting exploit kits using redirection chain sequences

“…Redirection chains are mapped in Takata et al (2018), but, content-based redirects are not considered. Shibahara et al (2019) models redirections irrespective of occurrence, e.g. if URL is found in JS but wasn't accessed, it's still labelled as a redirect.…”

REdiREKT: Extracting Malicious Redirections from Exploit Kit Traffic

“…Shibahara et al [25] leveraged redirection subgraph similarities to identify evasive, malicious websites. Classification is performed using a graph mining approach, where the sim-ilarities between redirection subgraphs of malicious, benign and compromised websites are integrated.…”