Abstract:Promotional infection is an attack in which the adversary exploits a website's weakness to inject illicit advertising content. Detection of such an infection is challenging due to its similarity to legitimate advertising activities. An interesting observation we make in our research is that such an attack almost always incurs a great semantic gap between the infected domain (e.g., a university site) and the content it promotes (e.g., selling cheap viagra). Exploiting this gap, we developed a semantic-based technique, called Semantic Inconsistency Search (SEISE), for efficient and accurate detection of the promotional injections on sponsored top-level domains (sTLD) with explicit semantic meanings. Our approach utilizes Natural Language Processing (NLP) to identify the bad terms (those related to illicit activities like fake drug selling, etc.) most irrelevant to an sTLD's semantics. These terms, which we call irrelevant bad terms (IBTs), are used to query search engines under the sTLD for suspicious domains. Through a semantic analysis on the results page returned by the search engines, SEISE is able to detect those truly infected sites and automatically collect new IBTs from the titles/URLs/snippets of their search result items for finding new infections. Running on 403 sTLDs with an initial 30 seed IBTs, SEISE analyzed 100K fully qualified domain names (FQDN), and along the way automatically gathered nearly 600 IBTs. In the end, our approach detected 11K infected FQDN with a false detection rate of 1.5% and over 90% coverage. Our study shows that by effective detection of infected sTLDs, the bar to promotion infections can be substantially raised, since other non-sTLD vulnerable domains typically have much lower Alexa ranks and are therefore much less attractive for underground advertising. Our findings further bring to light the stunning impacts of such promotional attacks, which compromise FQDNs under 3% of .edu, .gov domains and over one thousand gov.cn domains, including those of leading universities such as stanford.edu, mit.edu, princeton.edu, havard.edu and government institutes such as nsf.gov and nih.gov. We further demonstrate the potential to extend our current technique to protect generic domains such as .com and .org.

IDTracker: Discovering Illicit Website Communities Via Third-party Service IDs.

TraffickStop: Detecting and Measuring Illicit Traffic Monetization Through Large-scale DNS Analysis

Illegal website identification method based on template detection

Detecting Fake Accounts in Online Social Networks at the Time of Registrations.

A Big Data architecture for early identification and categorization of dark web sites

Linking Multiple User Identities of Multiple Services from Massive Mobility Traces

Inferring Hidden IoT Devices and User Interactions Via Spatial-Temporal Traffic Fingerprinting

Identifying Illicit Drug Dealers on Instagram with Large-scale Multimodal Data Fusion

Resident Evil: Understanding Residential IP Proxy As a Dark Service

Tracing Tor Hidden Service Through Protocol Characteristics

Measurement of the Usage of Web Clips in Underground Economy

ENiD: an Encrypted Web Pages Traffic Identification Based on Web Visiting Behavior

Battling the Internet Water Army: Detection of Hidden Paid Posters

Hide and seek in Slovakia: utilizing tracking code data to uncover untrustworthy website networks

Towards understanding bogus traffic service in online social networks

Eriskcom: an E-Commerce Risky Community Detection Platform

Identifying Disinformation Websites Using Infrastructure Features

I Do Not Know What You Visited Last Summer: Protecting Users from Stateful Third-Party Web Tracking with TrackingFree Browser

Seeking Nonsense, Looking for Trouble: Efficient Promotional-Infection Detection through Semantic Inconsistency Search

Understanding and Detecting Abused Image Hosting Modules As Malicious Services