Team for Research in
Ubiquitous Secure Technology

Citation
Tyler Moore, Nektarios Leontiadis, Nicolas Christin. "Fashion Crimes: Trending-Term Exploitation on the Web". Proceedings ACM CCS 2011, October, 2011.

Abstract
Online service providers are engaged in constant conflict with miscreants who try to siphon a portion of legitimate traffic to make illicit profits. We study the abuse of “trending” search terms, in which miscreants place links to malware-distributing or ad-filled web sites in web search and Twitter results, by collecting and analyzing measurements over nine months from multiple sources. We devise heuristics to identify ad-filled sites, report on the prevalence of malware and ad-filled sites in trending-term search results, and measure the success in blocking such content. We uncover collusion across offending domains using network analysis, and use regression analysis to conclude that both malware and ad-filled sites thrive on less popular, and less profitable trending terms. We build an economic model informed by our measurements and conclude that ad-filled sites and malware distribution may be economic substitutes. Finally, because our measurement interval spans February 2011, when Google announced changes to its ranking algorithm to root out low-quality sites, we can assess the impact of searchengine intervention on the profits miscreants can achieve.

Electronic downloads

• HTML

  Tyler Moore, Nektarios Leontiadis, Nicolas Christin. <a
  href="http://www.truststc.org/pubs/781.html"
  >Fashion Crimes: Trending-Term Exploitation on the
  Web</a>, Proceedings ACM CCS 2011, October, 2011.

• Plain text

  Tyler Moore, Nektarios Leontiadis, Nicolas Christin.
  "Fashion Crimes: Trending-Term Exploitation on the
  Web". Proceedings ACM CCS 2011, October, 2011.

• BibTeX

  @inproceedings{MooreLeontiadisChristin11_FashionCrimesTrendingTermExploitationOnWeb,
      author = {Tyler Moore and Nektarios Leontiadis and Nicolas
                Christin},
      title = {Fashion Crimes: Trending-Term Exploitation on the
                Web},
      booktitle = {Proceedings ACM CCS 2011},
      month = {October},
      year = {2011},
      abstract = {Online service providers are engaged in constant
                conflict with miscreants who try to siphon a
                portion of legitimate traffic to make illicit
                profits. We study the abuse of �trending�
                search terms, in which miscreants place links to
                malware-distributing or ad-filled web sites in web
                search and Twitter results, by collecting and
                analyzing measurements over nine months from
                multiple sources. We devise heuristics to identify
                ad-filled sites, report on the prevalence of
                malware and ad-filled sites in trending-term
                search results, and measure the success in
                blocking such content. We uncover collusion across
                offending domains using network analysis, and use
                regression analysis to conclude that both malware
                and ad-filled sites thrive on less popular, and
                less profitable trending terms. We build an
                economic model informed by our measurements and
                conclude that ad-filled sites and malware
                distribution may be economic substitutes. Finally,
                because our measurement interval spans February
                2011, when Google announced changes to its ranking
                algorithm to root out low-quality sites, we can
                assess the impact of searchengine intervention on
                the profits miscreants can achieve.},
      URL = {http://www.truststc.org/pubs/781.html}
  }
  

Posted by Nicolas Christin on 1 Oct 2011.
For additional information, see the Publications FAQ or contact webmaster at www truststc org.