Forschungsberichte der Fakultät IV – Elektrotechnik und Informatik C UJO : Efficient Detection and Prevention of Drive-by-Download Attacks

By Konrad Rieck, Tammo Krueger, Andreas Dewald. 2010

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Poisoning Attacks against Support Vector Machines (2012, background): “…to a number of such security-sensitive tasks including spam, worm, intrusion and fraud detection (Meyer & Whateley, 2004; Biggio et al., 2010; Stolfo et al., 2003; Forrest et al., 1996; Bolton & Hand, 2002; Cova et al., 2010; Rieck et al., 2010; Curtsinger et al., 2011; Laskov & ˇSrndi´c, 2011).”
Practical Evasion of a Learning-Based Classifier: A Case Study (2014, methodology): “Similar approach has been recently explored for detection of JavaScript malware, with the same techniques applied to sequences of syntactic tokens [41], [42].”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, methodology): “Machine learning has become a standard tool for malware research in the academic security community: it has been used in a wide range of domains including Windows malware [9, 28, 41], PDF malware [22, 26], malicious URLs [23, 39], Javascript malicious code [8, 35], and Android malware [4, 10, 15, 27”
Static detection of malicious JavaScript-bearing PDF documents (2011, methodology): “In a related comparative evaluation against Cujo [19] in the context of web-based JavaScript attacks (drive-bydownloads), Wepawet was a clear winner with a detection rate of 99.8% compared to 94.4%.”
EvilSeed: A Guided Approach to Finding Malicious Web Pages (2012, background): “DOI 10.1109/SP.2012.33 428 Thus, one requires a fast, but possibly imprecise, prefilter to quickly discard pages that are very likely to be legitimate.”
ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection (2011, methodology): “[22] describe Cujo, an system that combines static and dynamic features in a classifier framework based on support vector machines.”
Detection of Intrusions and Malware, and Vulnerability Assessment (2013, methodology): “Currently, if all domains in the landing URLs of a server stop resolving, the milking queries two passive DNS services [27,28] for alternative domains recently observed resolving to the exploit server.”
Detection of Malicious PDF Files Based on Hierarchical Document Structure (2013, methodology): “Both of these methods are focused on detection of malicious JavaScript content in PDF documents, which relates them to a large body of work on detection of drive-by-downloads; e.g., [27, 31, 10, 6].”