2011/11/1 1 Long Lu, Wenke Lee College of Computing Georgia Inst. of Technology Roberto Perdisci Dept. of Computer Science University of Georgia ACM CCS 2010

Agenda  Introduction  SURF  Search Engine  Search Poisoning  SURF Implementation & Evaluation  Discussion  Empirical Measurements  Related Work  Conclusion 2011/11/1 2

Introduction  Blackhat SEO Blackhat SEO  Search inflating  Search poisoning  SURF : detection system  Generality  Robustness  Wide deployability 2011/11/1 3

SURF (Search User Redirection Finder)  Run as a browser component(plugin) 2011/11/1 4

SURF  Report an in-depth study to motivate and inspire countermeasures against this increasing threat.  Be able to detect search poisoning with a 99.1% true positive rate at a 0.9% false positive rate  Provides insight into its fast growing trends. 2011/11/1 5

Search Engine  Search engines typically employ crawlers to discover newly created or updated webpages  Two advantages for abusers  Search engines trust the content on the webpages  a web server can easily distinguish between search crawlers and human visitors 2011/11/1 6

Search Poisoning  Preliminary study aimed to discover a set of robust features that can be leveraged for detection purposes  Ubiquitous use of cross-site redirections  Search poisoning as a service Search poisoning as a service  Sophisticated poisoning and evasion tricks  Persistence under transient appearances Persistence under transient appearances  Various malicious applications Various malicious applications 2011/11/1 7

Search Poisoning  Detection features 2011/11/1 8

SURF Implementation  As a plugin on IE8  “mshtml.dll” for HTML parsing  Listening for event notification  Peek into browser data  Emulating simple user interactions  Use BLADE to protect from drive-by download malwareBLADE 2011/11/1 9

SURF Evaluation  Three different experiments  Estimate SURF’s accuracyaccuracy  Attempts to show that SURF is able to detect generic search poisoning cases  Show what features are the most important for classification  IP-to-name ratio  redirection consistency & landing to terminal distance  2011/11/1 10

Discussion  During feature selection process, we discarded a few candidate features that may help the classification accuracy but are not robust(15 → 9)  Detecting search poisoning cases can reveal information about compromised websites and botnet organizations.  Single client side-share information 2011/11/1 11

Empirical Measurements  Micro Measurements 2011/11/1 12

Empirical Measurements  Macro Measurements 2011/11/1 13

Empirical Measurements 2011/11/1 14 Poor Japan earthquake Super Bowl

Empirical Measurements 2011/11/1 15

Related Work  Blackhat SEO countermeasures  Most detection methods work at the search engine level  Malicious webpage detection 2011/11/1 16

Conclusion  SURF : a novel detection system that runs as a browser component  Detect malicious search user redirections resulted from user clicking on poisoned search results  Robust features that is hard to evade  Detection rate of 99.1% at a false positive rate of 0.9% 2011/11/1 17

Thanks for your listening 2011/11/1 18

2011/11/1 19 Dynamically dispatch

D: drive-by-download F: fake AV P: rogue pharmacy Na: randomly legitimate search redirection cases 2011/11/1 20