6th European Conference - Academic Conferences

Manoj Cherukuri and Srinivas Mukkamala
Figure 16: Screenshot of the website medicalmarijuanablog.com
6. Link visualization
Links were visualized on the Google maps using the Google maps application programming interface
(API). The pre-computed geographic locations of the websites using the IP address to location
database were used to plot them on to the Google maps. Link visualization provides an interactive
means for analyzing the patterns followed by the links among different websites. The interactive map
helps in zooming and displays the name of the website on clicking the marker.
In Figure 17, the malicious websites and the facilitating websites are marked with red and blue
markers respectively. The red lines represent the bidirectional links, the green lines represent the
incoming link with respect to the facilitating website and the blue lines represent the outgoing link with
respect to the facilitating website. The lines going out from one extreme are connected through the
other extreme. From the above two images it is evident that the links are traversing among the
malicious domains across different countries presenting the fact that the attackers are not limiting the
hosting of their malicious websites either to a hosting service or to a country.
In Figure 18, the red lines represent the bi-directional links and the green lines represent the
unidirectional links. In Figure 19, on selecting a domain all the links associated with malicious
domains are depicted on the map. The green line represents an incoming link with respect to the
selected domain, the red line represents a bidirectional link and the blue line represents the outgoing
link with respect to the selected domain.
7. Conclusion
In this work we presented some interesting heuristics of the malicious websites that help in enhancing
the mechanisms used for the detection of malicious websites.
We identified the behavior of the malicious websites with respect to their indegrees and outdegrees.
We defined an equation that fits to the behavior of the indegree and the outdegree of the malicious
websites, which followed the power law with exponential cutoff.
Compared the outdegree of the malicious websites with that of the legitimate websites and concluded
that the malicious websites tend to have low outdegree compared to the legitimate websites.
We computed the clustering coefficient of the malicious websites and compared to that of the
legitimate websites and showed that the linking among the malicious websites is low compared to that
of the legitimate websites.
Our results during the analysis showed that the attackers are using legitimate websites with high
Google page rank as the means for directing traffic towards the malicious websites.
64