What's Clicking What? Techniques and Innovations of Today's Clickbots

Abstract. With the widespread adoption of Internet advertising, fraud has become a systemic problem. While the existence of clickbots—malware specialized for conducting click-fraud—has been known for a number of years, the actual functioning of these programs has seen little study. We examine the operation and underlying economic models of two families of modern clickbots, “Fiesta” and “7cy.” By operating the malware specimens in a controlled environment we reverse-engineered the protocols used to direct the clickbots in their activities. We then devised a milker program that mimics clickbots requesting instructions, enabling us to extract over 360,000 click-fraud directives from the clickbots’ control servers. We report on the functioning of the clickbots, the steps they employ to evade detection, variations in how their masters operate them depending on their geographic locality, and the differing economic models underlying their activity.

• Type: Journal
• Year: 2011
• Where: DIMVA
• Authors: Brad Miller, Paul Pearce, Chris Grier, Christian Kreibich, Vern Paxson
• Keywords: Computer Networks, Control Servers, DIMVA 2011, Economic Models, Geographic Locality