Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures

By Zhou Li, Sumayah A. Alrwais, Yinglian Xie, Fang Yu, Xiaofeng Wang. 2013

120 citations recorded by the source corpus.

Malicious Web activities continue to be a major threat to the safety of online Web users. Despite the plethora forms of attacks and the diversity of their delivery channels, in the back end, they are all orchestrated through malicious Web infrastructures, which enable miscreants to do business with each other and utilize others' resources. Identifying the linchpins of the dark infrastructures and distinguishing those valuable to the adversaries from those disposable are critical for gaining an upper hand in the battle against them. In this paper, using nearly 4 million malicious URL paths crawled from different attack channels, we perform a large-scale study on the topological relations among hosts in the malicious Web infrastructure. Our study reveals the existence of a set of topologically dedicated malicious hosts that play orchestrating roles in malicious activities. They are well connected to other malicious hosts and do not receive traffic from legitimate sites. Motivated by their distinctive features in topology, we develop a graph-based approach that relies on a small set of known malicious hosts as seeds to detect dedicate malicious hosts in a large scale. Our method is general across the use of different types of seed data, and results in an expansion rate of over 12 times in detection with a low false detection rate of 2%. Many of the detected hosts operate as redirectors, in particular Traffic Distribution Systems (TDSes) that are long-lived and receive traffic from new attack campaigns over time. These TDSes play critical roles in managing malicious traffic flows. Detecting and taking down these dedicated malicious hosts can therefore have more impact on the malicious Web infrastructures than aiming at short-lived doorways or exploit sites.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

1. Binghui Wang
2. Neil Zhenqiang Gong
3. Jinyuan Jia
4. Davide Balzarotti
5. Le Zhang
6. Hao Fu

In Information Systems

1. Neil Zhenqiang Gong
2. Binghui Wang
3. Jinyuan Jia
4. Davide Balzarotti
5. Nizar Kheir
6. Xiao Han
7. Le Zhang
8. Hao Fu

In Signal Processing

1. Jinyuan Jia
2. Neil Zhenqiang Gong
3. Davide Balzarotti
4. Nizar Kheir
5. Binghui Wang
6. Xiao Han

Citations in the corpus

• Attacking Graph-based Classification via Manipulating the Graph Structure (2019, methodology): “r reputation scores, assign/learn the edge weights, and propagate the prior reputation scores. In particular, state-of-the-art collective classification methods include Random Walk (RW) based methods [9, 10, 30, 36, 40, 72, 74, 76], Loopy Belief Propagation (LBP) based methods [1, 14, 23, 25, 47, 59”
• PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, background): “Finally, it describes the low-level implementation details and discusses the potential limitations of our approach.”
• Graph-based Security and Privacy Analytics via Collective Classification with Joint Weight Learning and Propagation (2018, background): “RW-N [13], [14], [26]–[28], [34] leverages labeled negative nodes to assign prior reputation scores, e.g., every labeled negative node in the training dataset has a prior reputation score of -1 (the absolute value of the reputation score does not matter since these RW-based methods rely on relative…”
• The Role of Cloud Services in Malicious Software: Trends and Insights (2015, methodology): “Note that the use of passive DNS service only provides an estimation of the real lifetime of these domains but this is an approximation that is often used for this type of measurements [16].”