6th European Conference - Academic Conferences

Manoj Cherukuri and Srinivas Mukkamala
Figure 9: Count of malicious websites versus outdegree on the log-log scale for the malicious and the
non-malicious websites
The average outdegree of the malicious websites was 3.9 with a standard deviation of 6.04. The
average outdegree of the non-malicious websites was 39.17 with a standard deviation of 30.64. The
standard deviation of the non-malicious websites was very high compared to the malicious websites.
The standard deviation of the outdegree of the malicious websites and the non-malicious websites
about the mean signify that the major portion of the non-malicious websites have an outdegree
greater than 10 and the major portion of the malicious websites have an outdegree less than10. The
spike in the series of malicious websites at the outdegree of 89 was due to a cluster of websites
(about 35 websites) which had links to each other randomly.
5.2 Malicious websites linked through a non-malicious website
For this analysis, a graph G (V, E) was constructed, where V is the set of vertices and E is the set of
edges. All the distinct domains obtained during the construction of the link structure were considered
as the vertices of graph G. Based on the links obtained during the construction of link structure, the
vertices were connected with directional edges.
All the malicious websites that were part of the link structure were loaded into set S. In order to
identify the non-malicious websites facilitating malicious websites, all the vertices which were not in S
and had a minimum of one edge pointing towards them from a vertex in S and minimum of one edge
emerging from them towards another vertex in S were selected.
In our study of link analysis, it was observed that around 5000 malicious websites were linked through
950 non-malicious websites. In this analysis, we tried to identify the domains which were not malicious
but had links to malicious websites.
In order to make the study effective, some of these non-malicious domains were visited manually to
get a better knowledge about how the links to malicious domains were being placed in the nonmalicious
domains. The main reason for this sort of linking was that the traffic sellers have built up
websites with high pagerank that drives traffic towards the malicious websites which are short lived
and according to Stevens (2010), the traffic sellers are paid based on the number of clicks or number
of victims.
As most of the traffic towards the non-popular domains is obtained through search engines, the traffic
sellers are using these non-malicious domains as the means of driving towards the newly built
malicious websites. The distribution of the outdegrees of the facilitating websites is shown in Figure
10. Figures 11, 12 and 13 show screenshots of websites promoting malicious websites in different
ways.
60