超越黑名单：建模恶意软件传播和干预的效果
Beyond the Blacklist: Modeling Malware Spread and the Effect of Interventions
摘要：
恶意软件在网站之间以及网站与客户端之间的传播是一个日益严重的问题。搜索引擎在引导用户访问网站方面发挥着重要作用，并且是使用黑名单等机制进行干预的自然控制点。本文提出了一个简单的马尔可夫模型的恶意软件通过大量的网站传播，并研究了两种干预措施，可能会部署由搜索提供商的影响：黑名单感染的网页从搜索结果中删除它们完全和黑名单的泛化，称为depreferencing，其中一个网站的排名是由一个固定的百分比下降，每次该网站仍然感染。我们分析和研究了不同干预措施的感染暴露和误报造成的流量损失（错误列入黑名单的网站的成本）之间的权衡。正如预期的那样，我们发现当网站删除感染的速度很慢时，干预措施是最有效的。令人惊讶的是，我们还发现，低感染率或恢复率可能会增加由于误报造成的流量损失。我们的分析还表明，重尾分布的网站受欢迎程度，在许多研究中记录，导致所有测量结果的高样本方差。这些结果意味着，它将很难确定经验是否某些网站的干预措施是有效的，它表明，理论模型，如本文所述的一个在提高网络安全发挥了重要作用。
英文摘要：
Malware spread among websites and between websites and clients is an increasing problem. Search engines play an important role in directing users to websites and are a natural control point for intervening, using mechanisms such as blacklisting. The paper presents a simple Markov model of malware spread through large populations of websites and studies the effect of two interventions that might be deployed by a search provider: blacklisting infected web pages by removing them from search results entirely and a generalization of blacklisting, called depreferencing, in which a website's ranking is decreased by a fixed percentage each time period the site remains infected. We analyze and study the trade-offs between infection exposure and traffic loss due to false positives (the cost to a website that is incorrectly blacklisted) for different interventions. As expected, we find that interventions are most effective when websites are slow to remove infections. Surprisingly, we also find that low infection or recovery rates can increase traffic loss due to false positives. Our analysis also shows that heavy-tailed distributions of website popularity, as documented in many studies, leads to high sample variance of all measured outcomes. These result implies that it will be difficult to determine empirically whether certain website interventions are effective, and it suggests that theoretical models such as the one described in this paper have an important role to play in improving web security.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
