Query: malicious advertisement

title: A deep learning based framework for detecting and visualizing online malicious advertisement
abstract: Online advertisement detection has attracted increasing attention in recent years in both academia and industry. The existing advertising blocking systems are vulnerable to the evolution of new attacks and can cause time latency issues by querying remote servers. In this thesis, we propose a lightweight detection system depending only on lexical based features. The statistical analysis of different URL sources shows that lexical based features can provide sufficient information for online advertisement representation. Deep learning algorithms are used for online advertising classification and visualization. After optimizing the architecture of the deep neural network, the deep learning based approach can achieve satisfactory detection results with false negative rate as low as 1.31% In URL visualization, with the implementation of AutoEncoder for feature preprocessing and t SNE for visualization, our approach outperforms other dimensionality reduction algorithms and can generate clear clusters for different URL families. Finally, a sequence 2 sequence model is built for fake URL generation, which can create distinguishing characteristics for fake malicious URLs.

title: Automated malicious advertisement detection using VirusTotal, URLVoid, and TrendMicro
abstract: The Internet economy is based on free access to content in exchange of viewing advertisements that might lead to online purchases. Advertisements represent an important source of revenue to Advertising companies. Those companies employ every possible technique and trick to maximize clicks and visits to advertisers' websites. Modern websites exchange advertisement contents from ads' providers (such as Google AdSense) which means they do not control the contents of those advertisements. Although large providers such as Google and Yahoo! are supposed to be trustworthy, ad arbitration allows them to auction of those ad slots to other providers. Therefore, web administrators cannot guarantee the source of the ads on their delegated website areas. Those advertisements contain Javascript and may redirect to malicious websites which might lead to malicious code being executed or malware being installed. This paper proposes and implements a system for automatically detecting malicious advertisements. It employs three different online malware domain detections systems (VirusTotal, URLVoid, and TrendMicro) for malicious advertisements detection purposes and reports the number of detected malicious advertisements using each system. In addition, we study the efficiency of each system by calculating the confusion matrix and accuracy. We find that URLVoid is the best in terms of accuracy (73% because it uses a combination of well known website scanners and domain blacklists.

title: Malicious advertisement recognition method and device
abstract: The embodiment of the invention discloses a malicious advertisement recognition method and device. The method comprises the following steps: acquiring an information source; sliding a slide window of first time length from a first end of the information source to a second end of the information source at firs slide speed; scanning N or more similar information elements in an information unit of the information source covered at each pause of the slide window and determining that the plural similar information elements are malicious advertisements, wherein N is an integer which is greater than or equal to 2, and the plural similar information elements indicate that plural information elements with similarity of being greater than a first threshold value. Correspondingly, the embodiment of the invention provides a malicious advertisement recognition device. According to the embodiment of the invention, malicious advertisements can be quickly and effectively recognized.

title: Impact of Malicious Node on Secure Incentive Based Advertisement Distribution (SIBAD) in VANET
abstract: Last decade has seen an increasing demand for vehicle aided data delivery. This data delivery has proven to be beneficial for vehicular communication. The vehicular network provisions safety, warning and infotainment applications. Infotainment applications have attracted drivers and passengers as it provides location based entertainment services, a value add to the traveling experience. These infotainment messages are delivered to the nearby vehicles in the form of advertisements. For every advertisement disseminated to its neighboring vehicle, an incentive is awarded to the forwarder. The incentive based earning foresee a security threat in the form of a malicious node as it hoards the incentives, thus are greedy for earning incentives. The malicious behavior of the insider has an adverse effect on the incentive based advertisement distribution approach. In this paper, we have identified the malicious nodes and analyzed its effect on incentive based earning for drivers in vehicular networks.

title: Securing IPv6 Wireless Networks Against Malicious Router Advertisements
abstract: With the increasing number of devices connected to the internet and scarcity of IPv4 addresses, the IPv6 protocol was designed to address various of the limitations of IPv4 networks, supporting 128 bit addresses, deploying a fragmentation mechanism aiming better routers performance, use of multicast instead of broadcast and more. However, challenging security issues have been discovered on its design, with researches actively working to reduce the impact of cyber attacks exploring such breaches. One of these issues allows malicious IPv6 nodes to pretend they are actual gateways of a network, allowing for Denial of Service and Man in the Middle attacks. This work proposes the Fingerprint based Router Advertisement Guard (FibRA Guard) a mechanism to avoid the spread of malicious Router Advertisements on wireless networks, relying on non intrusive fingerprint authentication of sources of suspicious Router Advertisements based on the time each device takes to generate and send IPv6 packets. On a testbed with 15 devices, FibRA Guard was able to identify sources of packets with an average accuracy of 96% proving to be a reliable solution towards wireless IPv6 networks secured against malicious Router Advertisements.

title: CELAH IPV6 ROUTER ADVERTISEMENT PADA SISTEM OPERASI WINDOWS
abstract: Dengan makin berkurangnya jumlah IPv4 yang tersedia maka perlu dipertimbangkan penggunaan IPv6. Akan tetapi IPv6 sendiri masih memiliki celah keamanan antara lain celah keamanan serangan flooding Router Advertisement palsu. Router Advertisement flood sendiri adalah merupakan serangan IPv6 DoS di jaringan lokal. Serangan ini membanjiri segmen jaringan lokal dengan Malicious Router Advertisement untuk menggantikan entri routing yang sah pada antarmuka suatu host. Tujuan dari penelitian ini adalah mempelajari respon Sistem Operasi dengan platform Windows terhadap serangan IPv6 Router Advertisement di jaringan, serta memberikan rekomendasi solusi untuk menutup celah keamanan tersebut. Pengujian serangan dilakukan dengan dua tahapan yaitu pengiriman paket flood RA dengan single prefix dan multi prefix.

title: PAD: Programming third party web advertisement censorship
abstract: In the current online advertisement delivery, an ad slot on a publisher's website may go through multiple layers of bidding and reselling until the final ad content is delivered. The publishers have little control on the ads being displayed on their web pages. As a result, website visitors may suffer from unwanted ads such as malvertising, intrusive ads, and information disclosure ads. Unfortunately, the visitors often blame the publisher for their unpleasant experience and switch to competitor websites. In this paper, we propose a novel programming support system for ad delivery, called PAD, for publisher programmers, who specify their policies on regulating third party ads shown on their websites. PAD features an expressive specification language and a novel persistent policy enforcement runtime that can self install and self protect throughout the entire ad delegation chain. It also provides an ad specific memory protection scheme that prevents malvertising by corrupting malicious payloads. Our experiments show that PAD has negligible runtime overhead. It effectively suppresses a set of malvertising cases and unwanted ad behaviors reported in the real world, without affecting normal functionalities and regular ads.

title: Impact evaluation and detection of malicious spoofing attacks on BLE based occupancy detection systems
abstract: Occupancy detection is beneficial for applications such as emergency management and building energy management, as it provides information on the location of occupants. Internet of Things (IoT) devices such as Bluetooth Low Energy (BLE) beacons installed in a building can benefit the performance of occupancy detection systems, by providing information on an occupant's location. However, BLE beacons operate by broadcasting advertisement messages, and this renders them vulnerable to network attacks. Here, we evaluate the effect of two types of malicious spoofing attacks on a BLE based occupancy detection system, and propose an attack detection method. The building blocks of the system include BLE beacons installed inside the building, a mobile application installed on occupants' phones, and a remote control server where we perform occupancy detection using machine learning. Our real world experimental results indicate that the attacks can significantly affect the system's performance. Also, our proposed detection method is able to accurately detect an attack by an adversary with physical access, with accuracy ranging from 84% to 91%

title: Ad Injection at Scale: Assessing Deceptive Advertisement Modifications
abstract: Today, web injection manifests in many forms, but fundamentally occurs when malicious and unwanted actors tamper directly with browser sessions for their own profit. In this work we illuminate the scope and negative impact of one of these forms, ad injection, in which users have ads imposed on them in addition to, or different from, those that websites originally sent them. We develop a multi staged pipeline that identifies ad injection in the wild and captures its distribution and revenue chains. We find that ad injection has entrenched itself as a cross browser monetization platform impacting more than 5% of unique daily IP addresses accessing Google tens of millions of users around the globe. Injected ads arrive on a client's machine through multiple vectors: our measurements identify 50,870 Chrome extensions and 34,407 Windows binaries, 38% and 17% of which are explicitly malicious. A small number of software developers support the vast majority of these injectors who in turn syndicate from the larger ad ecosystem. We have contacted the Chrome Web Store and the advertisers targeted by ad injectors to alert each of the deceptive practices involved.

title: Knowing your enemy: understanding and detecting malicious web advertising
abstract: With the Internet becoming the dominant channel for marketing and promotion, online advertisements are also increasingly used for illegal purposes such as propagating malware, scamming, click frauds, etc. To understand the gravity of these malicious advertising activities, which we call malvertising, we perform a large scale study through analyzing ad related Web traces crawled over a three month period. Our study reveals the rampancy of malvertising: hundreds of top ranking Web sites fell victims and leading ad networks such as DoubleClick were infiltrated. To mitigate this threat, we identify prominent features from malicious advertising nodes and their related content delivery paths, and leverage them to build a new detection system called MadTracer. MadTracer automatically generates detection rules and utilizes them to inspect advertisement delivery processes and detect malvertising activities. Our evaluation shows that MadTracer was capable of capturing a large number of malvertising cases, 15 times as many as Google Safe Browsing and Microsoft Forefront did together, at a low false detection rate. It also detected new attacks, including a type of click fraud attack that has never been reported before.