TC: Small: Collaborative Research: Predictive Blacklisting for Detecting Phishing Attacks

网络欺诈每年给消费者和企业造成数十亿美元的损失。通过垃圾邮件和社交工程的创造性组合，攻击者经常引诱最终用户访问钓鱼网站、恶意软件托管网站和诈骗网站。针对基于网络的攻击的一种流行的防御机制是列入黑名单，但今天的黑名单受到三个基本决定的影响。首先，它们中的大多数采用网络爬行和人工干预相结合的方式来推断恶意网站。这增加了添加条目的固有延迟，并导致许多恶意站点被遗漏。其次，黑名单主要基于准确的URL字符串，因此无法适应攻击者目前用来逃避检测的URL的简单更改。第三，随着黑名单条目的增加，将它们与URL进行实时匹配可能会造成性能瓶颈。为了克服这些不足，该项目正在开发新的机制，以帮助实时构建、维护和匹配黑名单。具体地说，它正在开发一种可扩展的架构，可以通过被动观察不法分子利用的新技术的启动来发现新的恶意网站，例如重定向和网络流量的快速流动。该体系结构还利用常见的攻击者倾向来找到从现有列入黑名单的URL中发现新的恶意URL的新颖且自动化的方法。该项目的最后重点是开发高速近似匹配算法，以便有效地将网络内黑名单列入黑名单，以将嵌入到数据包中的URL与潜在的数百万个黑名单条目进行匹配。如果成功，这个项目将使数百万互联网用户的网络更加安全。

Internet fraud costs consumers and businesses billions of dollars each year. Through creative combinations of spam and social engineering, attackers regularly lure end users into visiting phishing sites, malware-hosting sites, and scam sites. One popular defense mechanism against Web-based attacks is blacklisting, but today's blacklists suffer from three fundamental deciencies. First, most of them employ a combination of Web crawling and human intervention to infer malicious sites. This adds an inherent delay in adding entries and causes many malicious sites to be missed. Second, blacklists are mostly based on exact URL strings, and hence unable to adapt to simple changes to the URLs that attackers are using today to evade detection. Third, as blacklist entries grow, matching them against URLs in real-time could create performance bottlenecks. To overcome these deficiencies, this project is developing novel mechanisms to aid in the construction, maintenance, and matching of blacklists in real time. Specifically, it is developing a scalable architecture that can discover new malicious websites by passively observing the onset of new techniques exploited by the miscreants, such as redirects and fast flux in network traffic. The architecture also leverages common attacker tendencies to find novel and automated ways of discovering new malicious URLs from existing blacklisted URLs. The final thrust of the project is on developing high-speed approximate matching algorithms for effective in-network blacklisting to match URLs embedded in packets against potentially millions of blacklist entries. If successful, this project will make the Web safer for millions of Internet users.