2013 APWG eCrime Researchers Summit最新文献

$1.00 per RT #BostonMarathon #PrayForBoston: Analyzing fake content on Twitter #波士顿马拉松#为波士顿祈祷:分析推特上的虚假内容

2013 APWG eCrime Researchers Summit Pub Date : 2013-10-20 DOI: 10.1109/ECRS.2013.6805772

Aditi Gupta, Hemank Lamba, P. Kumaraguru

{"title":"$1.00 per RT #BostonMarathon #PrayForBoston: Analyzing fake content on Twitter","authors":"Aditi Gupta, Hemank Lamba, P. Kumaraguru","doi":"10.1109/ECRS.2013.6805772","DOIUrl":"https://doi.org/10.1109/ECRS.2013.6805772","url":null,"abstract":"Online social media has emerged as one of the prominent channels for dissemination of information during real world events. Malicious content is posted online during events, which can result in damage, chaos and monetary losses in the real world. We analyzed one such media i.e. Twitter, for content generated during the event of Boston Marathon Blasts, that occurred on April, 15th, 2013. A lot of fake content and malicious profiles originated on Twitter network during this event. The aim of this work is to perform in-depth characterization of what factors influenced in malicious content and profiles becoming viral. Our results showed that 29% of the most viral content on Twitter, during the Boston crisis were rumors and fake content; while 51% was generic opinions and comments; and rest was true information.We found that large number of users with high social reputation and verified accounts were responsible for spreading the fake content. Next, we used regression prediction model, to verify that, overall impact of all users who propagate the fake content at a given time, can be used to estimate the growth of that content in future. Many malicious accounts were created on Twitter during the Boston event, that were later suspended by Twitter. We identified over six thousand such user profiles, we observed that the creation of such profiles surged considerably right after the blasts occurred. We identified closed community structure and star formation in the interaction network of these suspended profiles amongst themselves.","PeriodicalId":110678,"journal":{"name":"2013 APWG eCrime Researchers Summit","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-10-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130549657","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 141

10v3.c0ns 10 v3.c0ns

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ecrs.2013.6805773

Aunshul Rege

引用次数: 0

Favicon - a clue to phishing sites detection Favicon -一个线索，以钓鱼网站检测

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805775

Guanggang Geng, Xiaodong Lee, Wei Wang, S. Tseng

{"title":"Favicon - a clue to phishing sites detection","authors":"Guanggang Geng, Xiaodong Lee, Wei Wang, S. Tseng","doi":"10.1109/ECRS.2013.6805775","DOIUrl":"https://doi.org/10.1109/ECRS.2013.6805775","url":null,"abstract":"Phishing is a type of scam designed to steal user's identity. Typically, anti-phishing methods either use blacklists or recognize the phishing pattern with statistical learning. This paper focuses on a tiny but powerful visual element-favicon, which is widely used by phishers but ignored by anti-phishing researchers. Indeed, only some lowest-quality phishing campaigns do not use such favicons. By analyzing the characteristic of favicon in phishing sites, an alternative phishing detection method is proposed. Favicon detection and recognition locates the suspicious brand sites, including legitimate and fake brands sites, and then PageRank and DNS filtering algorithm discriminates the sites with branding rights from fake brands sites. To validate the effectiveness of the proposed method, we carried out two different experiments. One is collecting a diverse spectrum of corpora containing 3642 phishing cases containing favicons from PhishTank, and 19585 legitimate Web pages from DMOZ and Google; experimental evaluations on the data set show that the proposed method achieved over 99.50% TPR and 0.15% FPR. The other is validating the method in the real Web query environment; a total of 517 unique phishing URLs were found and reported to the Anti-Phishing Alliance of China in a month. The experimental results demonstrate the competitive performances of favicon detection and recognition method for anti-phishing in practice.","PeriodicalId":110678,"journal":{"name":"2013 APWG eCrime Researchers Summit","volume":"150 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122764668","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Voice of the customer 顾客的声音

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805771

Brad Wardman, Lisa Kelly, M. Weideman

引用次数: 682

A notation for describing the steps in indicator expansion 描述指示符展开步骤的符号

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805774

Jonathan M. Spring

引用次数: 3

An inquiry into money laundering tools in the Bitcoin ecosystem 对比特币生态系统中洗钱工具的调查

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805780

Malte Möser, Rainer Böhme, Dominic Breuker

{"title":"An inquiry into money laundering tools in the Bitcoin ecosystem","authors":"Malte Möser, Rainer Böhme, Dominic Breuker","doi":"10.1109/ECRS.2013.6805780","DOIUrl":"https://doi.org/10.1109/ECRS.2013.6805780","url":null,"abstract":"We provide a first systematic account of opportunities and limitations of anti-money laundering (AML) in Bitcoin, a decentralized cryptographic currency proliferating on the Internet. Our starting point is the observation that Bitcoin attracts criminal activity as many say it is an anonymous transaction system. While this claim does not stand up to scrutiny, several services offering increased transaction anonymization have emerged in the Bitcoin ecosystem - such as Bitcoin Fog, BitLaundry, and the Send Shared functionality of Blockchain.info. Some of these services routinely handle the equivalent of 6-digit dollar amounts. In a series of experiments, we use reverse-engineering methods to understand the mode of operation and try to trace anonymized transactions back to our probe accounts. While Bitcoin Fog and Blockchain.info successfully anonymize our test transactions, we can link the input and output transactions of BitLaundry. Against the backdrop of these findings, it appears unlikely that a Know-Your-Customer principle can be enforced in the Bitcoin system. Hence, we sketch alternative AML strategies accounting for imperfect knowledge of true identities but exploiting public information in the transaction graph, and discuss the implications for Bitcoin as a decentralized currency.","PeriodicalId":110678,"journal":{"name":"2013 APWG eCrime Researchers Summit","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129370100","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 331

Modeling malicious domain name take-down dynamics: Why eCrime pays 恶意域名删除动态建模:为什么eCrime付钱

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805779

Jonathan M. Spring

{"title":"Modeling malicious domain name take-down dynamics: Why eCrime pays","authors":"Jonathan M. Spring","doi":"10.1109/ECRS.2013.6805779","DOIUrl":"https://doi.org/10.1109/ECRS.2013.6805779","url":null,"abstract":"Domain names drive the ubiquitous use of the Internet. Criminals and adversaries also use domain names for their enterprise. Defenders compete to remove or block such malicious domains. This is a complicated space on the Internet to measure comprehensively, as the malicious actors attempt to hide, the defenders do not like to share data or methods, and what data is public is not consistently formatted. This paper derives an ad hoc model of this competition on large, decentralized networks using a modification of Lanchester's equations for combat. The model is applied to what is known of the current state of malicious domain activity on the Internet. The model aligns with currently published research, and provides a more comprehensive description of possible strategies and limitations based on the general dynamics of the model. When taken with the economic realities and physical laws to which the Internet is bound, the model demonstrates that the current approach to removing malicious domain names is unsustainable and destined for obsolescence. However, there are technical, policy, and legal modifications to the current approach that would be effective, such as preemptively populating watch lists, limits on a registrant's registrations, and international cooperation. The results indicate that the defenders should not expect to eliminate or significantly reduce malicious domain name usage without employing new digital tactics and deploying new rules in the physical world.","PeriodicalId":110678,"journal":{"name":"2013 APWG eCrime Researchers Summit","volume":"622 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115828026","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

An exploration of the factors affecting the advertised price for stolen data 对影响被盗数据广告价格的因素的探讨

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805781

T. Holt, Y. Chua, O. Smirnova

{"title":"An exploration of the factors affecting the advertised price for stolen data","authors":"T. Holt, Y. Chua, O. Smirnova","doi":"10.1109/ECRS.2013.6805781","DOIUrl":"https://doi.org/10.1109/ECRS.2013.6805781","url":null,"abstract":"A growing body of research has developed exploring the ways that data thieves dispose of information acquired through phishing, hacking, and mass data breaches. These studies suggest a range of products are sold in forums and IRC channels at a fraction of its true value. There is also substantial risk for participants as they may be cheated by vendors who may not deliver products or simply provide invalid data. These conditions have led researchers to question the nature of the market, in that the actual price for data is much higher than what is advertised based on the risk of repeatedly purchasing bad data. As a result, there may be multiple markets for data operating with different pricing based on the prevalence of unreliable vendors. In order to explore these issues, this study utilizes a sample of threads from 13 Russian and English language forums involved in the sale of stolen data to consider the influence of various social conditions on the advertised price for dumps and eBay and PayPal credentials. The findings suggest that prices are lower in markets where vendors may cheat customers, and higher in markets that appear more organized and legitimate. The implications of this study for future research are examined in depth.","PeriodicalId":110678,"journal":{"name":"2013 APWG eCrime Researchers Summit","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129336848","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 21

Empirical analysis of factors affecting malware URL detection 恶意软件URL检测影响因素实证分析

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805776

Marie Vasek, T. Moore

引用次数: 6

Phish-Net: Investigating phish clusters using drop email addresses 网络钓鱼:使用丢弃的电子邮件地址调查网络钓鱼集群

2013 APWG eCrime Researchers Summit Pub Date : 2013-09-01 DOI: 10.1109/ECRS.2013.6805777

Shams Zawoad, A. Dutta, A. Sprague, Ragib Hasan, Jason Britt, Gary Warner

{"title":"Phish-Net: Investigating phish clusters using drop email addresses","authors":"Shams Zawoad, A. Dutta, A. Sprague, Ragib Hasan, Jason Britt, Gary Warner","doi":"10.1109/ECRS.2013.6805777","DOIUrl":"https://doi.org/10.1109/ECRS.2013.6805777","url":null,"abstract":"The most common approach to collect users' secret credentials from phishing websites is to email the credentials to criminals' email addresses which we call drop email addresses. We propose a clustering algorithm, which is based on the assumption that if there is a common drop email address found in the phishing kits from two different phishing websites, then these two websites are directly related. Based on obfuscated and plain-text drop email addresses, we produce two types of clusters: one is called phishing kit creator cluster and another is kit user cluster. Clustering related phishing websites using our proposed approach will allow phishing investigators to focus their investigative efforts on important phishing attacks rather than random attacks. For example, in January 2013, 1475 phishing websites are hosted by only 317 groups of phishers (who we will call kit users). Our scheme will thus help investigators to narrow investigation to pervasive phishing criminals. By analyzing the clusters generated using our clustering approach, we can determine the strongest and most pervasive phishers, and phishing kit creators, relationships between phishing kit creators and phishing kit users, and the most dominant phisher of one group. These findings have real-life implication in phishing investigation paradigm.","PeriodicalId":110678,"journal":{"name":"2013 APWG eCrime Researchers Summit","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132698295","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 13