Almost safe-browsing: revealing trends in web-based malware distribution

Abstract

While the adversaries on the Internet host malicious web pages to compromise as many users as possible by leveraging the open nature of such public network, the defenders try to detect and block as many such malicious web pages as possible. The adversaries often attempt to evade the prevalent detection systems by deploying sneaky tactics. In order to reveal such tactical movement or trend in web-based malware distribution, this thesis introduces Malicious Domain Monitoring System that periodically monitors potentially malicious domains. In this work, two meaningful tactics were successfully revealed by analyzing the data collected by the monitoring system. Furthermore, this thesis presents the instances of domains successfully evading Google Safe Browsing detection system to show the significance of the revealed tactics and to emphasize the importance of trend analysis.