Monkey-Spider: Detecting Malicious Websites with Low-Interaction Honeyclients

Abstract: Client-side attacks are on the rise: malicious websites that exploit vulnerabilities in the visitor's browser are posing a serious threat to client security, compromising innocent users who visit these sites without having a patched web browser. Currently, there is neither a freely available comprehensive database of threats on the Web nor sufficient freely available tools to build such a database. In this work, we introduce the Monkey-Spider project [Mon]. Utilizing it as a client honeypot, we portray the challenge in such an approach and evaluate our system as a high-speed, Internetscale analysis tool to build a database of threats found in the wild. Furthermore, we evaluate the system by analyzing different crawls performed during a period of three months and present the lessons learned.

• Type: Conference
• Year: 2008
• Where: SICHERHEIT
• Authors: Ali Ikinci, Thorsten Holz, Felix C. Freiling
• Keywords: Available Comprehensive Database, Client-side Attacks, Patched Web Browser, Security Privacy, SICHERHEIT 2008