Ecole d'ingénieur et centre de recherche en Sciences du numérique

On the effectiveness of risk prediction based on users browsing behavior

Canali, Davide; Bilge, Leyla; Balzarotti, Davide

ASIACCS 2014, 9th ACM Symposium on Information, Computer and Communications Security, June 4-6, 2014, Kyoto, Japan

Users are typically the final target of web attacks: criminals are interested in stealing their money, their personal information, or in infecting their machines with malicious code. However, while many aspects of web attacks have been carefully studied by researchers and security companies, the reasons that make certain users more "at risk" than others are still unknown. Why do certain users never encounter malicious pages while others seem to end up on them on a daily basis? To answer this question, in this paper we present a comprehensive study on the effectiveness of risk prediction based only on the web browsing behavior of users. Our analysis is based on a telemetry dataset collected by a major AntiVirus vendor, comprising millions of URLs visited by more than 100,000 users during a period of three months. For each user, we extract detailed usage statistics, and distill this information in 74 unique features that model different aspects of the user's behavior. After the features are extracted, we perform a correlation analysis to see if any of them is correlated with the probability of visiting malicious web pages. Afterwards, we leverage machine learning techniques to provide a prediction model that can be used to estimate the risk class of a given user. The results of our experiments show that it is possible to predict with a reasonable accuracy (up to 87%) the users that are more likely to be the victims of web attacks, only by analyzing their browsing history.

Document Doi Bibtex

Titre:On the effectiveness of risk prediction based on users browsing behavior
Mots Clés:risk prediction, profiling, web browsing
Type:Conférence
Langue:English
Ville:Kyoto
Pays:JAPON
Date:
Département:Sécurité numérique
Eurecom ref:4252
Copyright: © ACM, 2014. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in ASIACCS 2014, 9th ACM Symposium on Information, Computer and Communications Security, June 4-6, 2014, Kyoto, Japan http://dx.doi.org/10.1145/2590296.2590347
Bibtex: @inproceedings{EURECOM+4252, doi = {http://dx.doi.org/10.1145/2590296.2590347}, year = {2014}, title = {{O}n the effectiveness of risk prediction based on users browsing behavior}, author = {{C}anali, {D}avide and {B}ilge, {L}eyla and {B}alzarotti, {D}avide}, booktitle = {{ASIACCS} 2014, 9th {ACM} {S}ymposium on {I}nformation, {C}omputer and {C}ommunications {S}ecurity, {J}une 4-6, 2014, {K}yoto, {J}apan }, address = {{K}yoto, {JAPON}}, month = {06}, url = {http://www.eurecom.fr/publication/4252} }
Voir aussi: