Detecting malicious behavior using an accomplice model
The present disclosure generally relates to web page analysis, and more particularly to detecting malicious behavior using an accomplice model. In certain embodiments, the accomplice model may determine that a URI is associated with malicious behavior based upon the URI being associated with an attribute determined to be related to malicious behavior. Examples of an attribute include a host system, a domain, or an element of a document used to render the web page. Examples of an element of a document used to render the web page may include an active/dynamic element (e.g., a function, a script, etc.) or an inactive/static element (e.g., a string, a number, a frame, a tracking username, a social networking username, etc.).
1. A method, comprising:
creating a uniform resource identifier (URI) list, which includes a plurality of URIs that are used to render a web page;
identifying an attribute associated with the web page;
identifying a number of web pages that are rendered and that cause a first URI associated with the attribute to be called without calling a second URI that is determined to be malicious;
calculating a score for the attribute based at least on the number of the web pages that are rendered and that cause the first URI associated with the attribute to be called without calling the second URI that is determined to be malicious;
classifying the attribute as malicious based at least on the score;
determining that an identified URI in the URI list is associated with the attribute; and
as a result of determining that the identified URI in the URI list is associated with the attribute, performing the following operations:
creating a blacklist incident for the identified URI; and
performing a security action with regard to the identified URI.
2. The method of claim 1 , further comprising:
using a statistical model to assign a plurality of reputation scores to the plurality of URIs in the URI list;
wherein the blacklist incident is created for the identified URI further as a result of a reputation score assigned to the identified URI exceeding a threshold value.
3. The method of claim 1 , wherein performing a security action comprises:
informing a user that the identified URI is malicious.
4. The method of claim 1 , wherein performing a security action comprises:
sending the identified URI to a system that removes code that causes the identified URI to be called.
5. The method of claim 1 , further comprising:
identifying indirect connections from one-time-use hosts that redirect to the web page.
6. The method of claim 1 , wherein creating the blacklist incident comprises:
adding the blacklist incident to a blacklist sequence that is segmented based on profiles of blacklist incidents.
7. The method of claim 1 , wherein creating the blacklist incident comprises:
adding the blacklist incident to a blacklist sequence; and
wherein the method further comprises:
identifying a social media username that is malicious by identifying blacklisted URIs in the blacklist sequence that are associated with the social media username.
8. The method of claim 1 , further comprising:
applying an exponential decay factor to the reputation score assigned to the identified URI, the exponential decay factor based at least on an amount of time since a host or domain associated with the identified URI was blacklisted.
9. The method of claim 1 , further comprising:
applying an exponential decay factor to the reputation score assigned to the identified URI, the exponential decay factor based at least on an amount of time since a blacklisted host or domain associated with the identified URI was crawled.
10. A system comprising:
a memory; and
one or more processors coupled to the memory, the one or more processors configured to:
create a uniform resource identifier (URI) list, which includes a plurality of URIs that are used to render a web page;
identify an attribute associated with the web page;
identify a number of web pages that are rendered and that cause a first URI associated with the attribute to be called without calling a second URI that is determined to be malicious;
calculate a score for the attribute based at least on the number of the web pages that are rendered and that cause the first URI associated with the attribute to be called without calling the second URI that is determined to be malicious;
classify the attribute as malicious based at least on the score;
determine that an identified URI in the URI list is associated with the attribute; and
as a result of a determination that the identified URI in the URI list is associated with the attribute:
create a blacklist incident for the identified URI; and
perform a security action with regard to the identified URI.
11. The system of claim 10 , wherein the one or more processors are further configured to:
use a statistical model to assign a plurality of reputation scores to the plurality of URIs in the URI list; and
wherein the one or more processors are configured to:
create the blacklist incident for the identified URI further as a result of a reputation score assigned to the identified URI exceeding a threshold value.
12. The system of claim 10 , wherein the one or more processors are configured to:
inform a user that the identified URI is malicious.
13. The system of claim 10 , wherein the one or more processors are configured to:
send the identified URI to a system that removes code that causes the identified URI to be called.
14. The system of claim 10 , wherein the one or more processors are further configured to:
identify indirect connections from one-time-use hosts that redirect to the web page.
15. The system of claim 10 , wherein the one or more processors are configured to:
add the blacklist incident to a blacklist sequence that is segmented based on profiles of blacklist incidents.
16. The system of claim 10 , wherein the one or more processors are configured to:
create the blacklist incident by adding the blacklist incident to a blacklist sequence; and
identify a social media username that is malicious by identifying blacklisted URIs in the blacklist sequence that are associated with the social media username.
17. The system of claim 10 , wherein the one or more processors are further configured to:
apply an exponential decay factor to the reputation score assigned to the identified URI, the exponential decay factor based at least on an amount of time since a host or domain associated with the identified URI was blacklisted.
18. The system of claim 10 , wherein the one or more processors are further configured to:
apply an exponential decay factor to the reputation score assigned to the identified URI, the exponential decay factor based at least on an amount of time since a blacklisted host or domain associated with the identified URI was crawled.
19. A computer program product comprising a non-transitory computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:
creating a uniform resource identifier (URI) list, which includes a plurality of URIs that are used to render a web page;
identifying an attribute associated with the web page;
identifying a number of web pages that are rendered and that cause a first URI associated with the attribute to be called without calling a second URI that is determined to be malicious;
calculating a score for the attribute based at least on the number of the web pages that are rendered and that cause the first URI associated with the attribute to be called without calling the second URI that is determined to be malicious;
classifying the attribute as malicious based at least on the score;
determining that an identified URI in the URI list is associated with the attribute; and
as a result of determining that the identified URI in the URI list is associated with the attribute:
creating a blacklist incident for the identified URI; and
performing a security action with regard to the identified URI.
20. The computer program product of claim 19 , wherein the operations further comprise:
applying an exponential decay factor to the reputation score assigned to the identified URI, the exponential decay factor based at least on at least one of:
an amount of time since a host or domain associated with the identified URI was blacklisted; or
an amount of time since a blacklisted host or domain associated with the identified URI was crawled.