Analysis of An Advanced Dynamicmobile Malicious Web Pages

Abstract

Cloaking is a technique to show different content depending on conditions reflecting who is visiting the site. In this scenario, cloaking can be successfully used by malware writers to avoid being detected when the malwaredetecting crawler visits a particular site. We have observed malware that checks if images have been successfully loaded before executing its attack. Accordingly, existing techniques to detect malicious websites are unlikely to work for such webpages. In this paper, we design and implement malicious web page tracker technique, a mechanism that distinguishes between malicious and benign mobile web pages. MWPT makes this determination based on static features of a webpage ranging from the number of frames to the presence of known fraudulent phone numbers. Finally, we build a browser extension using MWPT to protect users from malicious mobile websites in real-time.