Strategies for prioritization of malicious URL re-evaluation presented at Virus Bulletin 2011

by Kyle Zeeuwen (Sophos/university of british columbia),

URL : http://www.virusbtn.com/conference/vb2011/abstracts/Zeeuwen-etal.xml

Summary : We perform a study of Fake AV distribution networks advertised via SEO poisoning that affect our customers. Using a high
interaction fetcher we repeatedly evaluate the networks by querying the poisoned SEO pages. We identify means to group
Fake AV networks into families using URL pattern matching, and we find that each family exhibits distinct update
behaviours and sample characteristics. We identify the payload updating techniques used by each family, and show
different degrees of honey client blacklisting countermeasures used by the different families. We propose optimizations
to the re-evaluation logic for Fake AV networks based on these characteristics. We evaluate these optimizations and show
that they can be used to reduce the required fetch frequency by X%, which in turn reduces the likelihood of being
blacklisted.