6th European Conference - Academic Conferences

Link Analysis and Link Visualization of Malicious Websites
Manoj Cherukuri and Srinivas Mukkamala
(ICASA)/CAaNES)/New Mexico Institute of Mining and Technology, USA
manoj@cs.nmt.edu
srinivas@cs.nmt.edu
Abstract: In this paper we present web crawling, Meta searches, geo location tools, and computational intelligent
techniques to assess the characteristics of a cyber-incident to determine if an incident is likely to be caused by a
certain group, geographical location of the source, intent of the attack, and useful behavioral aspects of the
attack. The malicious websites extracted from the identified sources acted as seeds for our crawler and were
crawled up to two hops traversing through all the hyperlinks emerging out from these pages. After crawling, all
the websites were translated to their geographic locations based on the location of the server on which the
website is hosted using the Internet Protocol (IP) address to the geographical location mapping databases. We
applied social networking analysis techniques to the link structure of the malicious websites to put forward the
properties of the malicious websites and compared them with that of the legitimate websites. We identified the
potential sources or websites that publish malicious websites using the meta-searches. Our approach revealed
that the behavior of the malicious websites with respect to their indegrees, outdegrees and the clustering
coefficient differ from that of the legitimate websites and some malicious websites acted as promoters for other
malicious websites. The link visualization showed that the links traversing across the malicious websites are not
confined to the region where the website was hosted.
Keywords: link analysis, link visualization, malicious websites, social networking analysis techniques
1. Introduction
The increase in the number of internet users and bandwidth resulted in the proliferation of the
websites. World Internet Usage and Population Statistics (2010) stated that, as of June 2010, there
are about 2 billion internet users throughout the world with a growth rate of about 440% over a
decade. December 2009 Web Server Survey (2009) affirmed that there are about 240 million
websites hosted all over the world. The prospective growth rate of the internet users and their huge
number created a new means of making revenue for the attackers, people who contribute to the
malicious activities on the web. This huge market being exploited by the attackers is often referred to
as the Underground Economy. Cheng (2008) listed that, as of 2008, the market for the underground
economy was about US$276 million with a potential of billions of dollars. Luvender (2010) stated that,
as of April 2010, United States alone is facing a loss of about $200 billion per year.
A malicious website is a website which hosts malicious code to attack the client’s machine or spoofs
the client by building up a look alike. The malicious script on the webpage is executed on loading the
webpage and malicious script or file is installed without the users consent by exploiting the
vulnerability of an application or by other possible means. The installed program reports the user
sensitive data to the attacker. The underground economy has its own hierarchy of an organization
with different sets of people (based on their roles) working collaboratively to exploit the potential of the
underground economy. Important roles contributing to the hierarchy of the underground economies
suggested by Zhuge et al. (2007) are Virus Writers, Website Masters, Envelope Stealers, Virtual
Asset Stealers and Virtual Asset Sellers. Virus writers are responsible for writing up the malicious
code. Website masters build up the websites and attract the traffic to their hosted websites using the
approaches like search engine optimizations, blogging, spam etc. The terms website masters and
traffic sellers are used interchangeably in this document. Envelope stealer purchases the malicious
code and web traffic from the virus writers and website masters respectively. Envelope stealers
capture the raw data from the victim’s machine and sell it out to the virtual asset stealers. Virtual asset
stealers extract the useful information from the raw data purchased to convert it into a virtual asset.
Virtual asset stealer sells the virtual assets to the Virtual asset sellers. Virtual asset sellers sell the
virtual assets to the clients based on the type of the asset.
Figure 1 obtained from Google Online Security blog shows an increase in number of malicious
websites (Provos, 2010). The increase in the number of users of the internet had made the web a
promising means for spreading the malware. The exponential growth of the websites on the World
Wide Web has made the traditional crawling an infeasible option for detecting the malicious websites.
The crawling mechanism must be associated with intelligence to get an optimal detection rate, often
referred to as intelligent crawling. Previous works had shown that some of the hosting companies are
52