Detection of drive-by downloads based on the frequent embedded subtree pattern-mining algorithm
Wei Zou · Journal of Tsinghua University(Science and Technology) · 2011
A frequent embedded subtree pattern-mining algorithm was developed based on observations of the URL link tree structure of drive-by-download attack scenarios to extract typical frequent embedded subtree patterns from a large library of scenarios collected in the wild.35 extracted patterns were used to change a subtree matching algorithm into a behavior-based dynamic detection method for drive-by-downloads.Tests show that the purely dynamic detection method missed about 20% of the drive-by-downloads identified using the subtree matching algorithm based on the extracted patterns.Therefore,the subtree matching algorithm partially solves the problem of missed drive-by-downloads.These common subtree patterns provide a way to classify and trace the sources of drive-by-download attacks.