Website Defacement Research Articles

Exploiting the Capabilities of Classifiers to Examine a Website Defacement Data Set

Website defacement is the illegal electronic act of changing a website. In this paper, the capabilities of robust machine learning classifiers are exploited to select the best input feature set for evaluation of a website’s defacement risk. A defacement mining data set was obtained from Zone-H, a private organization, and a sample consisting of 93,644 data points was pre-processed and used for modelling purposes. Using multi-dimensional features as input, enormous modelling computations were carried out to determine the optimal outputs, in terms of performance. Reason and hackmode presented the highest contributions for the evaluation of website defacement, and were thus chosen as outputs. Various machine learning models were examined, and decision tree (DT), k-nearest neighbours (k-NN), and random forest (RF) were found to be the most powerful algorithms for prediction of the target model. The input variables 'domain', 'system', 'web_server', 'redefacement', 'type', 'def_grade', and 'reason/hackmode' were tested and used to shape the final model. Using the cross-validation (CV) technique, the key performance factors of the models were calculated and reported. After calculating the average scores for the hyperparameter metrics (i.e., max-depth, min-sample-leaf, weight, max-features, and CV), both targets were evaluated, and the learning algorithms were ranked as RF > DT > k-NN. The reason and hackmode variables were thoroughly analysed, and the average score accuracies for the reason and hackmode targets were 0.85 and 0.585, respectively. The results comprise a significant development, in terms of modelling and optimizing website defacement risk. This study successfully addresses key cybersecurity concerns, particularly website defacement.

Predicting new hackers’ criminal careers: A group-based trajectory approach

The current study employs group-based trajectory modeling to assess the longitudinal attack patterns of new hackers involved in website defacement. Specifically, we track the activity of 241 emergent hackers for one year following their first verified website defacement. In doing so, we find four distinct criminal trajectories: low threat (29.0%), naturally desisting (26.5%), increasingly prolific (22.3%), and persistent threat (22.1%). Hackers classified as low threats engage in few defacements, whereas persistent threats engage in high-frequency attacks. Those labeled as naturally desisting begin their careers with velocity but become less prolific with time. Conversely, those classified as increasingly prolific engage in more attacks as they advance in their criminal careers. Using a series of regression models, we find that digital artifacts and open-source intelligence are predictive of group involvement. The findings presented in this study contribute to our theoretical understanding of the developmental trajectories of hackers, while providing valuable insights in fostering targeted intervention strategies aimed at effectively mitigating and preventing cyber-attacks.

Website Defacement Detection and Monitoring Methods: A Review

Web attacks and web defacement attacks are issues in the web security world. Recently, website defacement attacks have become the main security threats for many organizations and governments that provide web-based services. Website defacement attacks can cause huge financial and data losses that badly affect the users and website owners and can lead to political and economic problems. Several detection techniques and tools are used to detect and monitor website defacement attacks. However, some of the techniques can work on static web pages, dynamic web pages, or both, but need to focus on false alarms. Many techniques can detect web defacement. Some are based on available online tools and some on comparing and classification techniques; the evaluation criteria are based on detection accuracies with 100% standards and false alarms that cannot reach 1.5% (and never 2%); this paper presents a literature review of the previous works related to website defacement, comparing the works based on the accuracy results, the techniques used, as well as the most efficient techniques.

Fine-grained Web Service Trust Detection: A Joint Method of Machine Learning and Blockchain

Current website defacement detection methods often ignore security and credibility in the detection process. Furthermore, with the gradual development of dynamic websites, false positives and underreports of website defacement have periodically occurred. Therefore, to enhance the credibility of website defacement detection and reduce the false-positive rate and the false-negative rate of website defacement, this paper proposes a fine-grained trust detection scheme called WebTD, that combines machine learning and blockchain. WebTD consists of two parts: an analysis layer and a verification layer. The analysis layer is the key to improving the success rate of website defacement detection. This layer mainly uses the naive Bayes (NB) algorithm to decouple and segment different types of web page content, and then preprocess the segmented data to establish a complete analysis model. Second, the verification layer is the key to establishing a credible detection mechanism. WebTD develops a new blockchain model and proposes a multi-value verification algorithm to achieve a multilayer detection mechanism for the blockchain. In addition, to quickly locate and repair the defaced data of the website, the Merkle tree (MT) algorithm is used to calculate the preprocessed data. Finally, we evaluate WebTD against two state-of-the-art research schemes. The experimental results and the security analysis show that WebTD not only establishes a credible web service detection mechanism but also keeps the detection success rate above 98%, which can effectively ensure the integrity of the website.

The Illicit Ecosystem of Hacking: A Longitudinal Network Analysis of Website Defacement Groups

Over the past four decades, research on hackers has widely propagated within the social sciences. Although this area of scholarship yields rich insight into the interpersonal dynamics of hackers, research on the unique ecosystems they create and inhabit is scant in comparison. The current study aims to offer a more complete assessment of hackers’ ecosystems by incorporating the group affiliations which link hackers to one another. Using 12 months of archived website defacement data containing individuals’ self-reported group affiliations alongside their hacking activities, the study reconstructs the social network of hacker groups over time. Findings reveal the illicit ecosystem to be loosely connected, yet densely clustered around a few central groups. The ecosystem also maintained its network features across the observation period with no sign of structural degradation. These findings corroborate extant research on the social environments of hackers, offer an innovative look into the illicit ecosystem of website defacers, and serve as a steppingstone to extend investigations of criminal behavior to the group-level.

Repeat victimization by website defacement: An empirical test of premises from an environmental criminology perspective

Repeat victimization has been widely studied from the perspective of environmental criminology for several decades. During this period, criminologists have identified a set of repeat victimization premises that are observed for many crimes; however, it is unknown whether these premises are also valid for cybercrime. In this study we rely on more than 9 million Zone-H data records from 2010 to 2017 to test whether these premises apply for the cybercrime of website defacement. We show that the phenomenon of repeat victimization is also observed in defaced cyber places (i.e. websites). In particular, we found that repeats contributed little to crime rates, that repeats occurred even several years after the original incident, that they were committed disproportionately by prolific offenders, and that few offenders returned to victimize previous targets. The results suggest that some traditional premises of repeat victimization may also be valid for understanding cybercrime events such as website defacement, implying that environmental criminology theories also constitute a useful framework for cybercrime analysis. The implications of these results in terms of criminological theory, cybercrime prevention, and the limitations derived from the use of Zone-H data are discussed.

Restrictive deterrence and the scope of hackers’ reoffending: Findings from two randomized field trials

Extensive criminological research has investigated the effectiveness of law enforcement efforts to prevent offenders' reoffending and effect changes in criminal behavior patterns. However, no research has quantified the influence of gossip regarding law enforcement operations and its effect on repeat offending. Moreover, only scant research has studied these relationships in the cyber-environment. The current work addresses this gap by studying the effect of online messages sent to active hackers that describe law enforcement efforts against website defacement activity. In two field experiments, we randomly assigned self-identified hackers with active Facebook accounts into control and treatment groups. We then sent subjects in the treatment group a gossip message (via Facebook) alerting them to law enforcement efforts in cyberspace. Following the intervention, we compared the control and treatment groups in terms of changes in the proportion of reoffending, number of website defacements, and severity of website defacements. Findings reveal that when the gossip was sent to a hacker's private inbox, it prompted a reduction in the proportion of hackers who reoffend, the frequency at which they reoffend, and the severity of attacks they generate. However, posting similar gossip on the hacker's Facebook wall was ineffective in restricting malicious hacking activity. Theoretical implications and practical recommendations for law enforcement operations in cyberspace are discussed.

Deep Dive into Directory Traversal and File Inclusion Attacks leads to Privilege Escalation

In Modern Web application directory traversal vulnerability that can potentially allow an attacker to view arbitrary files and some sensitive files. They can exploit identified vulnerabilities or misconfigurations to obtain root privileges. When building the web application, ensure that some arbitrary file is not publicly available via the production server. when an attacker can include. Traversal vulnerabilities this vulnerability exploits the dynamic file include a mechanism that exists in programming frameworks a local file inclusion happens when uncontrolled user input such as form values or headers for example are used to construct a file include paths. By exploiting directory traversal attacks in web servers, they can do anything and with chaining with code injection they can upload a shell into a web server and perform a website defacement attack. Path-traversal attacks take advantage of vulnerable Website parameters by including a URL reference to remotely hosted malicious code, allowing remote code execution and leads to privilege escalation attack.

Website Defacer Classification: A Finite Mixture Model Approach

Hackers often engage in website defacement early in their criminal careers to establish a reputation. Some hackers become increasingly prolific and launch a large number of attacks against their targets, whereas others only launch a few attacks before eventually desisting from a life of crime. A better understanding of why some hackers launch a large number of attacks, while others do not, will assist in the implementation of targeted intervention strategies. Therefore, the current study, using a sample of 119 active hackers, seeks to answer two research questions: (1) Are there different groups of website defacers based on attack volume? (2) Which observed hacker-level characteristics can be used to predict latent class membership? We find that two unique groups of website defacers exist: low-volume defacers (69%) and high-volume defacers (31%). Social media presence, the content of the defacement, and the type of defacement are all predictive of latent class membership. Policy implications are discussed.

Detecting Website Defacement Attacks using Web-page Text and Image Features

Recently, web attacks in general and defacement attacks in particular to websites and web applications have been considered one of major security threats to many enterprises and organizations who provide web-based services. A defacement attack can result in a critical effect to the owner’s website, such as instant discontinuity of website operations and damage of the owner’s reputation, which in turn may lead to huge financial losses. A number of techniques, measures and tools for monitoring and detecting website defacements have been researched, developed and deployed in practice. However, some measures and techniques can only work with static web-pages while some others can work with dynamic web-pages, but they require extensive computing resources. The other issues of existing proposals are relatively low detection rate and high false alarm rate because many important elements of web-pages, such as embedded code and images are not processed. In order to address these issues, this paper proposes a combination model based on BiLSTM and EfficientNet for website defacement detection. The proposed model processes web-pages’ two important components, including the text content and page screenshot images. The combination model can work effectively with dynamic web-pages and it can produce high detection accuracy as well as low false alarm rate. Experimental results on a dataset of over 96,000 web-pages confirm that the proposed model outperforms existing models on most of measurements. The model’s overall accuracy, F1-score and false positive rate are 97.49%, 96.87% and 1.49%, respectively.

Privacy Issues in Cyberspace: An Indian Perspective

Cyber privacy is controversial and as yet unresolved question in legal jurisprudence all around the world. In the new millennium, the present universe is encompassed by the power of new mantra namely ‘Information Technology’. The sempiternity of knowledge in the lap of ‘Information and Communication Technology Revolution’ has staggeringly brought the privacy of individuals into the forefront of the Jurisprudential consciousness. To what degree citizens of democratic nations would be willing to surrender their sensitive information is debatable. However, it is the responsibility of legal domain to prepare an adequate policy for the protection of privacy on the internet form cyber snooping, cyberstalking, corporate espionage, devasting cyber-attacks and website defacement. The computerization of society has important and possibly unsettling implications that invite a re-examination of the privacy in cyber world. This article has focused on the (i) Analysis of the novice modes of the tarnishing privacy in cyberspace in India and (ii) Legal control mechanism to combat commission of crimes.

The World of Defacers: Looking Through the Lens of Their Activities on Twitter

Many web-based attacks have been studied to understand how web hackers behave, but web site defacement attacks (malicious content manipulations of victim web sites) and defacers' behaviors have received less attention from researchers. This paper fills this research gap via a computational data-driven analysis of a public database of defacers and defacement attacks and activities of 96 selected defacers who were active on Twitter. We conducted a comprehensive analysis of the data: an analysis of a friendship graph with 10,360 nodes, an analysis on how sentiments of defacers related to attack patterns, and a topical modelling based analysis to study what defacers discussed publicly on Twitter. Our analysis revealed a number of key findings: a modular and hierarchical clustering method can help discover interesting sub-communities of defacers; sentiment analysis can help categorize behaviors of defacers in terms of attack patterns; and topic modelling revealed some focus topics (politics, country-specific topics, and technical discussions) among defacers on Twitter and also geographic links of defacers sharing similar topics. We believe that these findings are useful for a better understanding of defacers' behaviors, which could help design and development of better solutions for detecting defacers and even preventing impeding defacement attacks.

CBR-Based Decision Support Methodology for Cybercrime Investigation: Focused on the Data-Driven Website Defacement Analysis

Criminal profiling is a useful technique to identify the most plausible suspects based on the evidence discovered at the crime scene. Similar to offline criminal profiling, in-depth profiling for cybercrime investigation is useful in analysing cyberattacks and for speculating on the identities of the criminals. Every cybercrime committed by the same hacker or hacking group has unique traits such as attack purpose, attack methods, and target. These unique traits are revealed in the evidence of cybercrime; in some cases, these unique traits are well hidden in the evidence such that it cannot be easily perceived. Therefore, a complete analysis of several factors concerning cybercrime can provide an investigator with concrete evidence to attribute the attacks and narrow down the scope of the criminal data and grasp the criminals in the end. We herein propose a decision support methodology based on the case-based reasoning (CBR) for cybercrime investigation. This study focuses on the massive data-driven analysis of website defacement. Our primary aim in this study is to demonstrate the practicality of the proposed methodology as a proof of concept. The assessment of website defacement was performed through the similarity measure and the clustering processing in the reasoning engine based on the CBR. Our results show that the proposed methodology that focuses on the investigation enables a better understanding and interpretation of website defacement and assists in inferring the hacker’s behavioural traits from the available evidence concerning website defacement. The results of the case studies demonstrate that our proposed methodology is beneficial for understanding the behaviour and motivation of the hacker and that our proposed data-driven analytic methodology can be utilized as a decision support system for cybercrime investigation.

Website defacement and routine activities: considering the importance of hackers’ valuations of potential targets

ABSTRACTAlthough a relatively simple form of hacking, website defacement can have severe consequences both for the websites that are attacked and the reputation of their owners. However, criminological research has yet to fully explore the causes and correlates of website defacement. We consider whether variables derived from routine activity theory can be applied to understanding website defacement. Specifically, using a sample of websites that were targeted by hackers in 2017 across the world, we examine the relationship between a country’s structural characteristics and the frequency of website defacement reported for the country. We find that website defacements are less likely to occur in the presence of capable guardianship (strong military presence) and more likely to occur when certain measures of target suitability are present. Additionally, using hackers’ self-reported valuations of potential targets, we separate defacements into two groups, and examine whether websites targeted for political reasons have different correlates than websites targeted for recreational reasons. Findings reveal that recreational defacements are deterred by capable guardianship (strong military presence) and are influenced by certain measures of target suitability while political defacements are not.

Detecting Website Defacements Based on Machine Learning Techniques and Attack Signatures

Defacement attacks have long been considered one of prime threats to websites and web applications of companies, enterprises, and government organizations. Defacement attacks can bring serious consequences to owners of websites, including immediate interruption of website operations and damage of the owner reputation, which may result in huge financial losses. Many solutions have been researched and deployed for monitoring and detection of website defacement attacks, such as those based on checksum comparison, diff comparison, DOM tree analysis, and complicated algorithms. However, some solutions only work on static websites and others demand extensive computing resources. This paper proposes a hybrid defacement detection model based on the combination of the machine learning-based detection and the signature-based detection. The machine learning-based detection first constructs a detection profile using training data of both normal and defaced web pages. Then, it uses the profile to classify monitored web pages into either normal or attacked. The machine learning-based component can effectively detect defacements for both static pages and dynamic pages. On the other hand, the signature-based detection is used to boost the model’s processing performance for common types of defacements. Extensive experiments show that our model produces an overall accuracy of more than 99.26% and a false positive rate of about 0.27%. Moreover, our model is suitable for implementation of a real-time website defacement monitoring system because it does not demand extensive computing resources.

Application of deep learning to cybersecurity: A survey

Cutting edge Deep Learning (DL) techniques have been widely applied to areas like image processing and speech recognition so far. Likewise, some DL work has been done in the area of cybersecurity. In this survey, we focus on recent DL approaches that have been proposed in the area of cybersecurity, namely intrusion detection, malware detection, phishing/spam detection, and website defacement detection. First, preliminary definitions of popular DL models and algorithms are described. Then, a general DL framework for cybersecurity applications is proposed and explained based on the four major modules it consists of. Afterward, related papers are summarized and analyzed with regard to the focus area, methodology, model applicability, and feature granularity. Finally, concluding remarks and future work are discussed including the possible research topics that can be taken into consideration to enhance various cybersecurity applications using DL models.

THE POLITICS OF CYBER

ABSTRACTWe live in a world of competing nation states, proxies of those states and non-nation state actors. This competition manifests itself in any number of ways – conflict, sanctions, restrictions, embargo, assassinations, etc. Clausewitz’s suggested “War as politics by other means” so, the natural conclusion is cyber espionage, cyber-attacks and cyber influence operations, are merely manifestations of a policy clash between two or more competing powers or proxies. This article suggests the development of nation state Advanced Persistent Threat (APT) capability is a direct result of the collision of competing national interests and the national policy which drives those interests. Surprising no one the work required to counter these cyber threats is technically difficult and legally problematic. Charting a course from the early days of website defacement to Distributed Denial of Service Attacks (DDOS) the evolution of capability of APT actors has been significant and rapid. Contrasting this rapid advancement of Chinese, Iranian, Russian and North Korean APT actors is the lack of an effective dissuasive policy and a decidedly placid global political and legal response. With the notable American judicial system and policy apparatus it seems evident the USA remains a global cyber police force using a potent and extraordinary Extraterritorial jurisdiction (EJT) authority far outside of American borders to target both criminal and nation state actors.

Security control for website defacement

Cyber-attacks to websites are increasing steadily affecting the integrity and availability of information, so the implementation of safeguards to mitigate or reduce to acceptable levels the risks generated are necessary. Computer incidents produce economic and reputational impacts to different organizations. It has identified an increase in computer attacks on different organizations where one of them, and highly reputational impact, is the “Defacement” attack, which consists of unauthorized modification or alteration to the web sites using wordpress cms , affecting the integrity of information. The result of this article proposes the development of a model for establishing a security control to perform the containment and reporting of this attack type, which currently have focused on the websites of the government entities. The development model allows online control the attack on Web sites by constant reading of certain parts of the source code making the detection and maintenance of the integrity of information.

Entertaining Whilst Defacing Websites: Psychological Games for Hackers

Aim/Purpose: This study aims to investigate various characteristics from both victims as defaced websites and defacers that linked to a risk of being defaced through a set of descriptive analysis. Background: The current figures from a spectrum of sources, both academic and non-academic reports, proved a progressive increase of website defacement attacks to numerous organisations. Methodology: This study obtains a set of data from Zone-H site, which is accessible to the public, including 99,437 defaced websites. The descriptive analysis is applied in order to understand the motives of defacers and the probability of website re-defacements through the statistical investigation. Findings: The motives for defacing websites are driven mainly due to entertaining reasons. This in turn has an implication on the type of techniques defacers attack websites.

Policy Approval Engine - A Framework for Securing Web Applications and Web User

Background/Objectives: Web applications face variety of new extortions related to injections. Securing the web applications becomes paramount and an intricate process with the current technologies. The objective of this paper is to protect the web application form injection attacks. Methods/Statistical Analysis: Web publishers frequently integrate third-party advertisements into web pages that also contain sensitive end-user personal data. This may expose sensitive page content to confidentiality and integrity attacks launched by advertisements. Thus web browser needs some simple security policy and enforcement which can alleviate basic attacks in order to guard the applications and user that resides on the web. Findings: The policy enforcement framework for addressing security threats and to protect against cross-site request forgery, cross-site scripting, and content stealing has been proposed. To do so, the framework observes all outgoing web requests within the browser and offers authorization and approval checks before the contents are embedded into a page. Additionally, the advertisements are restricted to the access the user data. Thus, the paper delivers better understanding about web application security policy enforcement which protects user data from interactive ads. The proposed framework is compared with existing methods like SOMA and RequestPolicy and the result shows that the proposed method improves better security against attacks. The proposed framework decreases the false positive rate and false negative rate when compared to the existing framework. The accuracy of the proposed method is above 90%. Applications/Improvements: The proposed framework can be used to protect the web against cross-site request forgery, cross-site scripting, and content stealing. The future work focuses on providing security against web site defacement and other attacks.