1 Interactive Website

Though popularly used for safe web browsing, blacklist-based filters have funda-mental limitation in the “window of vulnerability”, the time between malicious website launch and blacklist update. An effective way of seamless protection is to use an add-on filter based on heuristics, but most of prior heuristics have offered the limited scope of protection against new attacks. Moreover, they have either suffered from low detection accuracy or incurred unacceptable slowdown. This paper presents an interactive website filter based on heuristics for detecting malicious websites. As the key feature, our filter considers the disparity between a website’s true identity (e.g., host domain) and its ob-served identity (e.g., frequent terms or source domains of iFrames). A website with sig-nificant disparity is considered as malicious. Users are warned against a website identi-fied as malicious, and determine if it is safe to proceed. Incorporating user-interaction into discovering the true identity of the suspect websites lets our filter avoid false posi-tives caused by automatic detection. Our main contribution is that we found a common and efficient characteristic to filter malicious websites. Not only is such disparity inher-ent in exploit mechanisms of malicious websites whether to aim for phishing or malware distribution, but its measuring by textual relevance incurs negligible overhead. Experi-mental results demonstrate that our filter is lightweight while delivering considerably high detection accuracy for both malicious websites