TWC: Small: Knowing Your Enemy: Understanding and Counteracting Web Malvertising

TWC：小：了解你的敌人：理解和对抗网络恶意广告

• 批准号: 1223477
• 负责人: XiaoFeng Wang
• 金额: $ 47.82万
• 依托单位: Indiana University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-09-01 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1223477&HistoricalAwards=false
• 关键词: TWC; Small; Knowing; Your; Enemy

With the Internet becoming the dominant channel for marketing and promotion, online advertisements (ad for short) are also increasingly used for propagating malware, committing scams, click frauds and other illegal activities. These activities, which we call malvertising, systematically deliver malicious ad content and victimize visitors through an infrastructure, which includes malicious advertisers, ad networks, redirection servers, exploit servers and others. Our preliminary study shows that most of such malvertising activities are missed by popular detection services such as Google Safe Browsing and Microsoft Forefront. This points to a disturbing lack of understanding of such web malvertising activities, which renders existing countermeasures less effective, and an urgent need to study the features of this threat to better prepares us to defend against it. The proposed research endeavors to gain a holistic, in-depth understanding about the scope and magnitude of malicious display, search and contextual advertising, features of their infrastructures and ad content, behavior of malicious ad-related parties, and economics of this underground business. Based upon such a understanding, we continue to develop novel infrastructure-aware technologies to detect these malicious activities, which include effective malvertising analysis techniques that capture malicious ads, advertisers and ad networks through web patrol, client-side defense that protects a user from stepping into exploit servers and publisher-side countermeasures that empower legitimate publishers and ad networks to shield their customers from such attacks. This research involves industry collaborators and also contributes to mitigation of other related threats such as black-hat Search Engine Optimization, SPAM-based phishing and drive-by-downloads.

随着互联网成为营销和推广的主要渠道，在线广告（简称广告）也越来越多地用于传播恶意软件，实施诈骗，点击欺诈和其他非法活动。这些活动，我们称之为恶意广告，系统地提供恶意广告内容，并通过一个基础设施，其中包括恶意广告商，广告网络，重定向服务器，利用服务器和其他受害者的访问者。我们的初步研究表明，大多数此类恶意广告活动都被流行的检测服务（如Google Safe Browsing和Microsoft Forefront）所遗漏。 这表明，人们对此类网络恶意广告活动缺乏了解，这使得现有的对策效果不佳，迫切需要研究这种威胁的特征，以便更好地防御它。拟议的研究努力全面深入地了解恶意显示、搜索和上下文广告的范围和程度，其基础设施和广告内容的特征，恶意广告相关方的行为，以及这种地下业务的经济学。基于这样的理解，我们继续开发新型的基础设施感知技术来检测这些恶意活动，其中包括通过网络巡逻捕获恶意广告、广告商和广告网络的有效恶意广告分析技术、保护用户的客户端防御。进入利用服务器和发布商端对策，使合法发布商和广告网络能够保护其客户免受此类攻击。这项研究涉及行业合作者，也有助于减轻其他相关的威胁，如黑帽搜索引擎优化，基于垃圾邮件的网络钓鱼和驱动下载。