TWC: Small: Knowing Your Enemy: Understanding and Counteracting Web Malvertising

随着互联网成为市场营销和推广的主要渠道，网络广告（简称广告）也越来越多地用于传播恶意软件、实施诈骗、点击欺诈和其他非法活动。这些活动，我们称之为恶意广告，通过包括恶意广告商、广告网络、重定向服务器、漏洞服务器等在内的基础设施，系统地传递恶意广告内容，并使访问者受害。我们的初步研究表明，大多数此类恶意广告活动都被谷歌Safe Browsing和Microsoft Forefront等流行的检测服务所遗漏。这表明，人们对此类网络恶意广告活动缺乏了解，这令人不安，这使得现有的对策不那么有效，迫切需要研究这种威胁的特征，以更好地为我们做好防范准备。本研究旨在全面深入地了解恶意展示、搜索和上下文广告的范围和规模，其基础设施和广告内容的特征，恶意广告相关方的行为，以及这种地下业务的经济性。基于这样的理解，我们继续开发新的基础设施感知技术来检测这些恶意活动，其中包括有效的恶意广告分析技术，通过网络巡逻捕获恶意广告，广告商和广告网络，客户端防御，保护用户不进入利用服务器，以及发布商端对策，授权合法发布商和广告网络保护其客户免受此类攻击。这项研究涉及行业合作者，也有助于缓解其他相关威胁，如黑帽搜索引擎优化、基于垃圾邮件的网络钓鱼和驱动下载。

With the Internet becoming the dominant channel for marketing and promotion, online advertisements (ad for short) are also increasingly used for propagating malware, committing scams, click frauds and other illegal activities. These activities, which we call malvertising, systematically deliver malicious ad content and victimize visitors through an infrastructure, which includes malicious advertisers, ad networks, redirection servers, exploit servers and others. Our preliminary study shows that most of such malvertising activities are missed by popular detection services such as Google Safe Browsing and Microsoft Forefront. This points to a disturbing lack of understanding of such web malvertising activities, which renders existing countermeasures less effective, and an urgent need to study the features of this threat to better prepares us to defend against it. The proposed research endeavors to gain a holistic, in-depth understanding about the scope and magnitude of malicious display, search and contextual advertising, features of their infrastructures and ad content, behavior of malicious ad-related parties, and economics of this underground business. Based upon such a understanding, we continue to develop novel infrastructure-aware technologies to detect these malicious activities, which include effective malvertising analysis techniques that capture malicious ads, advertisers and ad networks through web patrol, client-side defense that protects a user from stepping into exploit servers and publisher-side countermeasures that empower legitimate publishers and ad networks to shield their customers from such attacks. This research involves industry collaborators and also contributes to mitigation of other related threats such as black-hat Search Engine Optimization, SPAM-based phishing and drive-by-downloads.