Understanding, Measuring, and Detecting Modern Technical Support Scams
Understanding, Measuring, and Detecting Modern Technical Support Scams
复制标题
DOI：
10.1109/eurosp57164.2023.00011
复制
发表时间：
2023-07
期刊：
影响因子：
--
通讯作者：
Jienan Liu;Pooja Pun;Phani Vadrevu;R. Perdisci
中科院分区：
文献类型：
--
作者：
Jienan Liu;Pooja Pun;Phani Vadrevu;R. Perdisci
技术支持骗局(TSS)是一种社会工程攻击，旨在剥削对技术知识有限的用户，如老年人，给弱势公民造成重大经济损失。安全界试图用不同的对策来应对这些基于网络的诈骗。然而，据我们所知，到目前为止还没有提出强有力的对策来防御现代TSS活动，这些活动滥用网络搜索引擎来夸大其在搜索结果中的排名，并引诱许多潜在的受害者。为了防御这些TSS攻击，本文首先研究了TSS生态系统，特别关注现代TSS活动是如何在网络上运作和推广的。然后，我们利用我们的发现，提出了一个名为TASR的新型检测系统，该系统可以通过利用捕捉TSS网页如何推广的关键特征的功能，以与主题无关的方式将TSS网站与合法的技术支持网站区分开来。我们的交叉验证测试表明，TASR能够以低于1%的误检率检测出94.5%的TSS链接，显著优于以往的工作。
Technical support scams (TSS) are social engineering attacks that aim to exploit users that have limited knowledge about technology, such as the elderly, causing significant financial loss to vulnerable citizens. The security community has attempted to respond to these web-based scams with different countermeasures. However, to the best of our knowledge, no robust countermeasures have been proposed thus far to defend against modern TSS campaigns that abuse web search engines to inflate their rankings in search results and lure many potential victims.To defend against these TSS attacks, in this paper we first study the TSS ecosystem, with particular focus on how modern TSS campaigns are operated and promoted on the web. Then, we capitalize on our findings by proposing a novel detection system named TASR that can be used to differentiate TSS websites from legitimate technical support websites in a topic-agnostic way, by leveraging features that capture key traits of how TSS web pages are promoted. Our cross-validation tests show that TASR can detect 94.5% of the TSS links in web search results at a false positive rate of less than 1%, significantly outperforming previous work.