# Defacement Detection with Passive Adversaries
## 4 System Architecture and Implementation
### Basic Custom Tests (Fixed)  
The fixed tests are encoded custom tests, not resulting from a previous training phase. We soon realized this was necessary because in practice some simple, common sense checks are extremely effective. For example, just checking the existence of the correct company logo in the correct position detects a large number of real-life defacement instances.  
We will label these custom tests as \(T_{1},...,T_{n}\), and they are part of the \"fixed tests\" box in Figure 6. Some tests are binary (with 0 or \"fail\" meaning a possible defacement and 1 or \"success\" meaning a possibly normal content), other tests are weighted. The implemented tests may include the following:  
* dnsSpoof: given a list of IP addresses (or ranges of IP addresses specified with CIDR notation), it verifies that the response comes from a \"trusted\" IP address, belonging to the given list
* untrustedSources: given a list of trusted domains, it verifies that scripts or resources from external and untrusted sources are not included in the page
* publicDefacedSitelist: verifies that the given URL or its domain component are not present in the RSS feed of Zone-h.org, containing the list of the last 20 \"important\" sites that have been defaced
* imageNumber: compares the number of images in the previous and in the current DOM--if there is a difference of more than a given threshold (defaulting to 10%), the test fails
* lineNumber and wordNumber: same as the previous one, but the number of HTML lines and words is compared
* language: identifies the prevalent natural language in the downloaded content, and verifies that it is within a pre-configured list of accepted languages (e.g., English, Italian)
* wordBlacklist: given a word dictionary, divided in subcategories (e.g., hacking, spam, politics), it counts the number \(N_{u}\) of such undesired words or word variants in the page, and returns a weight \(w=N_{u}/N_{t}\), where \(N_{t}\) is the total number or words in the page
* diffDistance: using a sequence matching algorithm, the difference between the current and the previous DOM is computed (resulting in a floating-point number between 0 and 1, with 0 meaning equal, and 1 maximally different)--this is then combined with the site's changing frequency to yield a test output in the form of a numeric weight between 0 and 1
* diffOCR: starting from the page's screen shot, an OCR routine is run yielding an alphanumeric sequence; this is again processed as in the diffDistance test, yielding a difference weight between 0 and 1
* dictOCR: the words obtained via OCR are processed as in the wordBlacklist test
* fixedImage: a specific image in a specific position must occur (e.g., company logo)
* fixedText: a specific text sequence in a specific position must occur (e.g., company motto)
* applicationSpecific: other custom tests have been implemented that are specific to the target application. Some of the above tests are assigned a weight and are combined to yield a \"fixed test weight\". It is important to note that the computation of the above tests provides us, as a byproduct, with a number of computed quantities that will be useful for the following adaptive test. For example,the lineNumber test computes the number of lines, and the dictOCR test produces a list of words extracted from page images. These quantities are used as precomputed features in the adaptive test, avoiding duplicate evaluation of the same quantities. This is also why, in Figure 6, the adaptive test follows the fixed tests, and receives input from them. The fixed tests can run in parallel threads or processes, but the adaptive test will have to wait for all such processes to terminate before it can start execution.