Investigating Web Defacement Campaigns at Large
Investigating Web Defacement Campaigns at Large
复制标题
调查大规模的网络篡改活动
DOI：
10.1145/3196494.3196542
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Vincenzo Ciancaglini
中科院分区：
文献类型：
--
作者：
F. Maggi;Marco Balduzzi;Ryan Flores;Lion Gu;Vincenzo Ciancaglini
网站污损是在网站受损后更改其网页的做法。被篡改的页面，称为污损页面，会对受害网站的声誉和业务产生负面影响。以前的研究主要集中在检测，而不是深入探讨污损现象。在调查几个污损时，我们观察到污损者留下的文物允许专家分析师调查演员的作案手法和社会结构，并从单个污损页面扩展到一组相关的污损（即，acampaign）。然而，手动对数百万个事件执行这样的分析是乏味的，并且带来了可扩展性的挑战。从这些观察，我们提出了一种自动化的方法，有效地建立情报信息的原始污损页。我们的方法通过自动识别污损活动并为其分配有意义的文本标签来简化分析师的工作。应用于1300万污损记录的综合数据集，从1998年1月至9月。2016年，我们的方法使我们能够对网络污损活动进行首次大规模测量。此外，我们的方法旨在供分析师在业务上采用，以确定实地的活动。我们不仅仅是确认传闻证据。我们分析了现代毁容者的社会结构，其中包括孤独的个人以及相互合作的演员，或与团队合作，随着时间的推移而发展并主导现场。最后，我们在塑造世界的事件和污损运动的时间线之间画了一个平行线，代表了现代污损者的利益和方向的演变。
Website defacement is the practice of altering the web pages of a website after its compromise. The altered pages, calleddeface pages, can negatively affect the reputation and business of the victim site. Previous research has focused primarily on detection, rather than exploring the defacement phenomenon in depth. While investigating several defacements, we observed that the artifacts left by the defacers allow an expert analyst to investigate the actors' modus operandi and social structure, and expand from the single deface page to a group of related defacements (i.e., acampaign ). However, manually performing such analysis on millions of incidents is tedious, and poses scalability challenges. From these observations, we propose an automated approach that efficiently builds intelligence information out of raw deface pages. Our approach streamlines the analysts job by automatically recognizing defacement campaigns, and assigning meaningful textual labels to them. Applied to a comprehensive dataset of 13 million defacement records, from Jan. 1998 to Sept. 2016, our approach allowed us to conduct the first large-scale measurement on web defacement campaigns. In addition, our approach is meant to be adopted operationally by analysts to identify live campaigns on the field. We go beyond confirming anecdotal evidence. We analyze the social structure of modern defacers, which includes lone individuals as well as actors that cooperate with each others, or with teams, which evolve over time and dominate the scene. We conclude by drawing a parallel between the time line of World-shaping events and defacement campaigns, representing the evolution of the interests and orientation of modern defacers.