Detection of drive-by downloads based on the frequent embedded subtree pattern-mining algorithm

CORC > 北京大学 > 计算机科学技术研究所

	Detection of drive-by downloads based on the frequent embedded subtree pattern-mining algorithm
	Han, Xinhui ; Gong, Xiaorui ; Zhuge, Jianwei ; Zou, Lei ; Zou, Wei
刊名	qinghua daxue xuebaojournal of tsinghua university
	2011
英文摘要	A frequent embedded subtree pattern-mining algorithm was developed based on observations of the URL link tree structure of drive-by-download attack scenarios to extract typical frequent embedded subtree patterns from a large library of scenarios collected in the wild. 35 extracted patterns were used to change a subtree matching algorithm into a behavior-based dynamic detection method for drive-by-downloads. Tests show that the purely dynamic detection method missed about 20% of the drive-by-downloads identified using the subtree matching algorithm based on the extracted patterns. Therefore, the subtree matching algorithm partially solves the problem of missed drive-by-downloads. These common subtree patterns provide a way to classify and trace the sources of drive-by-download attacks.; EI; 0; 10; 1312-1317; 51
语种	英语
内容类型	期刊论文
源URL	[http://ir.pku.edu.cn/handle/20.500.11897/321386]
专题	计算机科学技术研究所
推荐引用方式 GB/T 7714	Han, Xinhui,Gong, Xiaorui,Zhuge, Jianwei,et al. Detection of drive-by downloads based on the frequent embedded subtree pattern-mining algorithm[J]. qinghua daxue xuebaojournal of tsinghua university,2011.
APA	Han, Xinhui,Gong, Xiaorui,Zhuge, Jianwei,Zou, Lei,&Zou, Wei.(2011).Detection of drive-by downloads based on the frequent embedded subtree pattern-mining algorithm.qinghua daxue xuebaojournal of tsinghua university.
MLA	Han, Xinhui,et al."Detection of drive-by downloads based on the frequent embedded subtree pattern-mining algorithm".qinghua daxue xuebaojournal of tsinghua university (2011).