Demalvertising: A Kernel Approach for Detecting Malwares in Advertising Networks

From search engines to e-commerce websites and online video channels to smartphone applications, most of the internet applications use advertising as one of their primary source of revenue generation. Malvertising is the act of distributing malicious software to users via advertisements on websites. The major causes of malvertisement are the presence of hundreds of third party advertising solutions and the improper verification of ads at the publisher’s site. Moreover, smartly tailored advertisements are placed which exploit a browser’s bugs and vulnerabilities to infect user with malicious software. In this paper, we highlight loopholes in the currently applied advertising policies and the vulnerabilities that are exploited to attack customers by serving malicious ads on user applications. The major contribution of the authors is a framework developed to identify malicious advertisements at the publishers’ end. It is based on two types of analyses. The first type of analysis involves static analysis of the advertisement’s source code. The other type is the behavioral analysis of the advertisements done in a secure sandboxed environment to detect any malicious activity. We extracted a total of 9 features from 15,000 advertisements and classified it using a trained one class SVM classifier. Our result shows that 53 % of the suspicious ads contain dubious iFrames while 69 % of them perform redirections followed by drive by download 18 % with very low false positive and false negative rates.