A Framework for Countering Drive-by Download Attacks

Recently, security incidents caused by Drive-by-Download attack (DBD attack) which exploits vulnerability in browser or browser's plug-in and infects user's machine with malware have increased. Unlike remote exploit attack, DBD attack is triggered by user access to a malicious web site. Therefore a passive monitoring technique such as darknet monitoring can never grasp the threat of DBD attack. In addition, malicious websites tend to change their URL at short intervals, it is necessary to detect the appearance of malicious websites quickly for efficient countermeasures. In this paper, we propose a novel framework for countering DBD attack. In the proposed framework, we deploy sensors that work inside web browsers on a large scale. The sensor collects information of web browsing when a user access websites. Then we analyze the collected information for detecting a website suspected as manipulated or malicious website quickly.