Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities

By Yi-Min Wang, Doug Beck, Xuxian Jiang, Roussi Roussev, Chad Verbowski, Shuo Chen, Samuel T. King. Network and Distributed System Security Symposium, 2006

433 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/f9e58fe835b68f09dcddd840aa9ce099c351c945

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection (2011, background): “Since they were first introduced in 2005, various studies have been published [15, 20, 25, 30–32].”
The Nepenthes Platform: An Efficient Approach to Collect Malware (2006, methodology): “The way out of this dilemma is to use client-side honeypots like HoneyMonkeys [22] or Kathy Wang’s honeyclient [21] to detect this kind of attacks.”
FlashDetect: ActionScript 3 Malware Detection (2012, unknown): “Examples are HoneyMonkey [25], CaptureHPC [22], Moshcuk et al. [16,17], Provos et al. [20], and Monkey-Spider [7].”
Ether: malware analysis via hardware virtualization extensions (2008, background): “Honeypot-based projects also employ virtual environments for trapping and investigating malware [31,36,46].”
Beyond blacklists: learning to detect malicious web sites from suspicious URLs (2009, background): “detect drive-by exploits by using behavioral detection (monitoring anomalous state changes in the VM) as well as detecting exploits of known vulnerabilities [25].”
A Survey on Malware Detection Using Data Mining Techniques (2017, background): “— Virtual Machine: Strider HoneyMonkeys [Wang et al. 2006a] determines malicious web sites by visiting them in a Microsoft Virtual PC-and Virtual Server-based environment and identifying persistent system state changes caused by such visits. vGrounds [Jiang et al. 2005] studies worm behavior in a…”
AppsPlayground: automatic security analysis of smartphone applications (2013, background): “Strider HoneyMonkey [27] loads webpages in the browser, automatically clicks dialog boxes to allow installation of any binary and then detect if it is malware.”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, background): “A client honeypot is a system designed to study attacks against client applications, in our case attacks against a webbrowser [31].”
EvilSeed: A Guided Approach to Finding Malicious Web Pages (2012, background): “Other detection systems look for changes to the persistent state of the operating system (such as additional files or processes) [2], [9], [10] once a page has been loaded.”
Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures (2013, background): “, [30], [27]) have proposed simple topological features such as “in-degrees” for ranking malicious sites.”
Prophiler: a fast filter for the large-scale detection of malicious web pages (2011, unknown): “, changes in the file system, the registry, or the set of running processes) [18,22,25,30].”
Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets (2012, background): “Other systematic security studies The third area of related work includes prior efforts [46, 50, 51] to systematically study malicious web contents.”
Identifying suspicious URLs: an application of large-scale online learning (2009, background): “Several projects have also explored operating systems-level techniques whereby the client visits the Web site using an instrumented virtual machine (VM) (Moshchuk et al., 2006; Wang et al., 2006; Provos et al., 2007).”
Effective and Efficient Malware Detection at the End Host (2009, background): “Also, a number of server-side [4, 43] and client-side honeypots [51] were introduced that allow analysts and researchers to gather malware samples in the wild.”
Scalability, fidelity, and containment in the potemkin virtual honeyfarm (2005, unknown): “’s HoneyMonkey system incorporates a Web crawler to gather candidate spyware applications [35]) but they require careful engineering to truly mimic the vulnerable character-”