Detection and analysis of drive-by-download attacks and malicious JavaScript code

By Marco Cova, Christopher Krügel, Giovanni Vigna. 2010

692 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Program Analysis & Verification, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Program Analysis & Verification

In Privacy & Security

In Signal Processing

Citations in the corpus

Poisoning Attacks against Support Vector Machines (2012, methodology): “In fact, learning approaches have already been used or proposed as solutions to a number of such security-sensitive tasks including spam, worm, intrusion and fraud detection (Meyer & Whateley, 2004; Biggio et al., 2010; Stolfo et al., 2003; Forrest et al., 1996; Bolton & Hand, 2002; Cova et al., 201”
Automatically Evading Classifiers: A Case Study on PDF Malware Classifiers (2016, methodology): “Since both of the classifiers we target employ the object structure of the PDF file as features, we need to generate variants by manipulating the PDF files at that level.”
Evading Classifiers by Morphing in the Dark (2017, background): “A line of works [13, 18] targeted JavaScript code embedded in the malicious PDFs (or PDF malware).”
FlashDetect: ActionScript 3 Malware Detection (2012, methodology): “Cova et al. describe JSAND [3], a tool for analyzing JavaScript with an approach that is related to FlashDetect’s approach, using classification based on a set of dynamic and static features.”
Comprehensive Analysis and Detection of Flash-Based Malware (2016, methodology): “Furthermore, Gordon implements an adaptive timeout mechanism rather than a fixed period of time as utilized in previous works [13, 19, 44].”
EvilSeed: A Guided Approach to Finding Malicious Web Pages (2012, methodology): “For example, Wepawet can process only about 100K URLs per day (one URL takes about one minute).”
Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting (2013, methodology): “printing, we used a list of 3,804 domains of sites that, when analyzed by Wepawet [27], requested the previously identified fingerprinting scripts.”
Towards Adversarial Malware Detection (2018, methodology): “Unfortunately, the Wepawet service is currently not available; hence it is not possible to test JSand anymore.”
Learning to Detect Phishing Webpages (2014, background): ““Number and target of redirections” is one of the 10 features used in detecting drive-by-download attacks [18].”
Static detection of malicious JavaScript-bearing PDF documents (2011, methodology): “As the baseline for comparison we consider Wepawet, a webbased service based on JSand [7].”
Data preprocessing for anomaly based network intrusion detection: A review (2011, methodology): “Using domain knowledge of drive-by-download behavior, and a fully emulated and instrumented browser, JSAND constructs 10 features (see Table 7) to represent the HTML and JavaScript code.”
ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection (2011, methodology): “2 Additionally, we include JSAND [6], a recently published malware detector that has a public web interface for malware upload and detection.”
Forschungsberichte der Fakultät IV – Elektrotechnik und Informatik C UJO : Efficient Detection and Prevention of Drive-by-Download Attacks (2010, methodology): “A detailed description of these classes is provided in [4].”
Behind the Scenes of Online Attacks: an Analysis of Exploitation Behaviors on the Web (2013, methodology): “All the links inserted in the forum posts underwent an indepth analysis using two automated, state-of-the-art tools for the detection of malicious web pages, namely Google Safe Browsing [22] and Wepawet [8].”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, background): “However, most classifier evasion attempts, including nine targeted mimicry scenarios from two recent studies, are given an outcome of uncertain indicating that these observations cannot be given a reliable prediction by the classifier.”
Anything to Hide? Studying Minified and Obfuscated Code in the Web (2019, background): “Other attacks aim at compromising the underlying browser [6, 7] or extensions installed in a browser [11, 12], or they abuse particular web APIs [19, 26, 30].”