Understanding the effectiveness of typosquatting techniques
Understanding the effectiveness of typosquatting techniques
复制标题
了解拼写错误技术的有效性
DOI：
10.1145/3132465.3132467
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Aziz Mohaisen
中科院分区：
文献类型：
--
作者：
Jeffrey Spaulding;Daehun Nyang;Aziz Mohaisen
这种恶意的排版做法包括故意注册包含排版错误的互联网域名，这些域名主要针对流行的域名，目的是将用户重定向到非预期的目的地，或者窃取流量以获取金钱利益。打字行为已经存在了20多年，直到今天仍然是一个可信的威胁。正如最近在线杂志Slate.com[19]所显示的那样，网络犯罪分子试图通过Netflix.com分发恶意软件，Netflix.com是流行的流媒体网站Netflix.com的一个类型匹配的变体，它使用阿曼(.om)的国家代码顶级域名(CcTLD)。虽然之前的许多工作都研究了各种打字技巧，以及它们是如何随着时间的推移而变化的，但没有人考虑到它们在欺骗用户方面的有效性。在这篇文章中，我们试图通过进行一项用户研究来填补这一空白，该研究将受试者暴露于几个统一资源定位符(URL)，试图确定在野外流行的几种类型匹配技术的有效性。我们还试图确定网络犯罪的安全教育和意识是否会影响互联网用户的行为。最终，我们发现，受试者倾向于正确地识别为域名添加字符的拼写，而欺骗用户的最有效技术涉及字符的排列和替换。我们还发现，受试者在接受了关于打字域名的彻底教育后，通常在识别打字域名方面表现得更好、更快，而且某些属性，如年龄和教育程度，会影响他们在接触到这些域名时的行为。
The nefarious practice of Typosquatting involves deliberately registering Internet domain names containing typographical errors that primarily target popular domain names, in an effort to redirect users to unintended destinations or stealing traffic for monetary gain. Typosquatting has existed for well over two decades and continues to be a credible threat to this day. As recently shown in the online magazine Slate.com [19], cybercriminals have attempted to distribute malware through Netflix.om, a typosquatted variant of the popular streaming site Netflix.com that uses the country code top-level domain (ccTLD) for Oman (.om). While much of the prior work has examined various typosquatting techniques and how they change over time, none have considered how effective they are in deceiving users. In this paper, we attempt to fill in this gap by conducting a user study that exposes subjects to several uniform resource locators (URLs) in an attempt to determine the effectiveness of several typosquatting techniques that are prevalent in the wild. We also attempt to determine if the security education and awareness of cybercrimes such as typosquatting will affect the behavior of Internet users. Ultimately, we found that subjects tend to correctly identify typosquatting which adds characters to the domain names, while the most effective techniques to deceive users involves permutations and substitutions of characters. We also found that subjects generally performed better and faster at identifying typosquatted domain names after being thoroughly educated about them, and that certain attributes such as Age and Education affect their behavior when exposed to them.
DNS 根处的 .onion 泄漏：测量、原因和对策
DOI：
10.1109/tnet.2017.2717965
发表时间：
2017
期刊：
IEEE/ACM Transactions on Networking
影响因子：
--
作者：
Mohaisen, Aziz;Ren, Kui
通讯作者：
Ren, Kui