I see EK: A lightweight technique to reveal exploit kit family by overall URL patterns of infection chains

Abstract

The prevalence and nonstop evolving technical sophistication of exploit kits (EKs) is one of the mostchallenging shifts in the modern cybercrime landscape. Over the last few years, malware infections via drive-by downloadattacks have been orchestrated with EK infrastructures. Malicious advertisements and compromised websites redirectvictim browsers to web-based EK families that are assembled to exploit client-side vulnerabilities and finally deliverevil payloads. A key observation is that while the webpage contents have drastic differences between distinct intrusionsexecuted through the same EK, the patterns in URL addresses stay similar. This is due to the fact that autogeneratedURLs by EK platforms follow specific templates. This practice in use enables the development of an efficient systemthat is capable of classifying the responsible EK instances. This paper proposes novel URL features and a new techniqueto quickly categorize EK families with high accuracy using machine learning algorithms. Rather than analyzing eachURL individually, the proposed overall URL patterns approach examines all URLs associated with an EK infectionautomatically. The method has been evaluated with a popular and publicly available dataset that contains 240 differentreal-world infection cases involving over 2250 URLs, the incidents being linked with the 4 major EK flavors that occurredthroughout the year 2016. The system achieves up to 100% classification accuracy with the tested estimators.