EAGER: ISN: Detecting and Disrupting Illicit Supply Networks via Traffic Distribution Systems

这项探索性研究的早期概念拨款（EAGER）将促进我们对破坏支持非法供应网络的在线基础设施的理解和能力，从而增强国家的健康、繁荣和安全。恶意广告导致很大一部分在线用户接触到恶意内容，包括来自非法供应网络的内容，比如贩卖假冒奢侈品和假冒药品的内容。这些滥用服务不仅泄露私人信息并造成经济损害，而且在未经许可的药品情况下，还可能损害公众健康。该项目侧重于开发方法，通过瞄准流量分配系统来检测和破坏这些非法供应链，即负责将用户从网关页面重定向到最终滥用服务的在线主机。测绘这些网络并最终摧毁它们的宿主将增加非法商业的成本，产生积极的经济和公共卫生影响。该奖项将为从事具有高社会影响的研究的研究生提供支持。该项目旨在了解、衡量、模拟和破坏交通分配系统，并描述这种破坏对非法商品和服务定价的影响。通过设计多个高毒性URL流，并每天从多个地理位置和多个浏览代理自动抓取这些URL，该项目将能够收集大量流量分配系统以及利用它们的滥用服务。该项目包括开发将收集到的网络轨迹转换为有向图的技术，属于同一参与者的节点的归属和合并，以及在存在操作约束的情况下使用这些图对拆除的影响进行建模。本研究将发现并记录这些非法操作的运作方式，改进对其滥用服务的自动检测，并为其他研究人员提供有关交通分配系统运行及其中断脆弱性的数据。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This EArly-concept Grant for Exploratory Research (EAGER) will enhance national health, prosperity, and security by contributing to our understanding of and ability to disrupt the online infrastructure that supports illicit supply networks. Malicious advertising is responsible for exposing a large fraction of online users to malicious content, including content from illicit supply networks, such as those trafficking in fake luxury goods and counterfeit pharmaceuticals. These abusive services not only exfiltrate private information and cause economic harm, but can also, in the case of unlicensed pharmaceutical products, damage public health. This project focuses on developing methods to detect and disrupt these illicit supply chains by targeting the traffic distribution systems that enable them, i.e., the online hosts that are responsible for redirecting users from gateway pages to the final abusive service. Mapping these networks and ultimately taking down their hosts will increase the cost of illicit commerce, yielding positive economic and public health impact. The award will provide support to engage graduate students in research with high societal impact.The project seeks to understand, measure, model, and disrupt traffic distribution systems as well as characterize the effects of this disruption on the pricing of illicit goods and services. By devising multiple high-toxicity URL streams and automatically crawling these URLs on a daily basis from multiple geographical locations and multiple browsing agents, this project will enable the collection of a large number of traffic distribution systems as well as the abusive services that utilize them. The project includes the development of techniques for converting the collected network traces into directed graphs, the attribution and merging of nodes belonging to the same actors, and the use of these graphs for modeling the effects of takedowns in the presence of operational constraints. This research will discover and document how these illicit operations function, improve the automated detection of their abusive services, and provide data to other researchers on the operations of traffic distribution systems and their vulnerability to disruptions.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.