REdiREKT: Extracting Malicious Redirections from Exploit Kit Traffic

摘要: This paper proposes REdiREKT, a system which utilises the open-source Zeek Intrusion Detection System (IDS) to map HTTP redirection chains observed in Exploit Kit (EK) attacks and extracts distinguishing features assist machine learning (ML). We build ground-truth dataset of EK samples, ensuring that for every sample are accurate reusable future experiments. By processing unique combination 9 techniques, REdiREKT was able correctly extract 96.52% malicious domains from 1279 spanning 28 families 8 campaigns, and, only failed 0.7% chains. Using VirusTotal API filter out flagged as malicious, we benign Alexa top 10k websites, extracting 12,783 5910 The data is divided into yearly familybased categories compared results. Based on our analysis collected data, store 48 key websites within could aid ML-based detection efforts. Finally, evaluate performance compare it with existing research, suggest use-cases areas work.