Automated malicious advertisement detection using VirusTotal, URLVoid, and TrendMicro
Automated malicious advertisement detection using VirusTotal, URLVoid, and TrendMicro
复制标题
使用 VirusTotal、URLVoid 和 TrendMicro 自动检测恶意广告
DOI：
10.1109/iacs.2017.7921994
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Monther Aldwairi
中科院分区：
文献类型：
--
作者：
Rima Masri;Monther Aldwairi
互联网经济的基础是免费访问内容，以换取观看可能导致在线购物的广告。广告是广告公司的重要收入来源。这些公司使用每一种可能的技术和技巧来最大化广告商网站的点击量和访问量。现代网站交换来自广告提供商(如Google AdSense)的广告内容，这意味着它们不控制这些广告的内容。尽管像谷歌和雅虎这样的大型提供商应该是值得信赖的，广告仲裁允许他们将这些广告位拍卖给其他供应商。因此，网络管理员不能保证他们授权的网站区域上的广告来源。这些广告包含Java脚本，可能会重定向到可能导致执行恶意代码或安装恶意软件的恶意网站。提出并实现了一种自动检测恶意广告的系统。它使用三种不同的在线恶意软件域检测系统(VirusTotal、URLVid和TrendMicro)来检测恶意广告，并使用每个系统报告检测到的恶意广告的数量。此外，我们还通过计算混淆矩阵和精度来研究各个系统的效率。我们发现URLVid在准确率方面是最好的(73%)，因为它结合了知名网站扫描程序和域名黑名单。
The Internet economy is based on free access to content in exchange of viewing advertisements that might lead to online purchases. Advertisements represent an important source of revenue to Advertising companies. Those companies employ every possible technique and trick to maximize clicks and visits to advertisers' websites. Modern websites exchange advertisement contents from ads' providers (such as Google AdSense), which means they do not control the contents of those advertisements. Although large providers such as Google and Yahoo! are supposed to be trustworthy, ad arbitration allows them to auction of those ad slots to other providers. Therefore, web administrators cannot guarantee the source of the ads on their delegated website areas. Those advertisements contain Javascript and may redirect to malicious websites which might lead to malicious code being executed or malware being installed. This paper proposes and implements a system for automatically detecting malicious advertisements. It employs three different online malware domain detections systems (VirusTotal, URLVoid, and TrendMicro) for malicious advertisements detection purposes and reports the number of detected malicious advertisements using each system. In addition, we study the efficiency of each system by calculating the confusion matrix and accuracy. We find that URLVoid is the best in terms of accuracy (73%) because it uses a combination of well known website scanners and domain blacklists.