Reflected Search Poisoning for Illicit Promotion

• URL: http://arxiv.org/abs/2404.05320v2
• Date: Thu, 11 Apr 2024 07:06:57 GMT
• Title: Reflected Search Poisoning for Illicit Promotion
• Authors: Sangyi Wu, Jialong Xue, Shaoxuan Zhou, Xianghang Mi,
• Abstract summary: We conduct the first security study on RSP-based illicit promotion. IPTs distributed via RSP are found to be large-scale, continuously growing, and diverse in both illicit categories and natural languages. We have identified over 11 million distinct IPTs belonging to 14 different illicit categories.
• Score: 2.0355793807035094
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As an emerging black hat search engine optimization (SEO) technique, reflected search poisoning (RSP) allows a miscreant to free-ride the reputation of high-ranking websites, poisoning search engines with illicit promotion texts (IPTs) in an efficient and stealthy manner, while avoiding the burden of continuous website compromise as required by traditional promotion infections. However, little is known about the security implications of RSP, e.g., what illicit promotion campaigns are being distributed by RSP, and to what extent regular search users can be exposed to illicit promotion texts distributed by RSP. In this study, we conduct the first security study on RSP-based illicit promotion, which is made possible through an end-to-end methodology for capturing, analyzing, and infiltrating IPTs. As a result, IPTs distributed via RSP are found to be large-scale, continuously growing, and diverse in both illicit categories and natural languages. Particularly, we have identified over 11 million distinct IPTs belonging to 14 different illicit categories, with typical examples including drug trading, data theft, counterfeit goods, and hacking services. Also, the underlying RSP cases have abused tens of thousands of high-ranking websites, as well as extensively poisoning all four popular search engines we studied, especially Google Search and Bing. Furthermore, it is observed that benign search users are being exposed to IPTs at a concerning extent. To facilitate interaction with potential customers (victim search users), miscreants tend to embed various types of contacts in IPTs, especially instant messaging accounts. Further infiltration of these IPT contacts reveals that the underlying illicit campaigns are operated on a large scale. All these findings highlight the negative security implications of IPTs and RSPs, and thus call for more efforts to mitigate RSP-driven illicit promotion.

Related papers

• Safety Devolution in AI Agents [56.482973617087254]
  This study investigates how expanding retrieval access affects model reliability, bias propagation, and harmful content generation.<n>Retrieval-augmented agents built on aligned LLMs often behave more unsafely than uncensored models without retrieval.<n>These findings underscore the need for robust mitigation strategies to ensure fairness and reliability in retrieval-augmented and increasingly autonomous AI systems.
  arXiv  Detail & Related papers  (2025-05-20T11:21:40Z)
• iEBAKER: Improved Remote Sensing Image-Text Retrieval Framework via Eliminate Before Align and Keyword Explicit Reasoning [80.44805667907612]
  iEBAKER is an innovative strategy to filter weakly correlated sample pairs. We introduce an alternative Sort After Reversed Retrieval (SAR) strategy. We incorporate a Keyword Explicit Reasoning (KER) module to facilitate the beneficial impact of subtle key concept distinctions.
  arXiv  Detail & Related papers  (2025-04-08T03:40:19Z)
• Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures [1.0787328610467801]
  This study examines the evolution of Advanced Persistent Threats (APTs) over 22 years. We focus on their evasion techniques and how they stay undetected for months or years. The most popular protocol to deploy evasion techniques is using HTTP(S) with 81% of APT campaigns.
  arXiv  Detail & Related papers  (2025-02-12T22:38:50Z)
• Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries [1.0787328610467801]
  We present EarlyCrow, an approach to detect APT malware command and control over HTTP(S) using contextual summaries. The design of EarlyCrow is informed by a novel threat model focused on TTPs present in traffic generated by tools recently used in APT campaigns. EarlyCrow defines a novel multipurpose network flow format called PairFlow, which is leveraged to build the contextual summary of a PCAP capture.
  arXiv  Detail & Related papers  (2025-02-07T22:38:39Z)
• Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search [20.796363884152466]
  We conduct the first safety risk quantification on seven production AIPSEs.<n>Our findings reveal that AIPSEs frequently generate harmful content that contains malicious URLs.<n>We develop an agent-based defense with a GPT-4.1-based content refinement tool and a URL detector.
  arXiv  Detail & Related papers  (2025-02-07T14:15:46Z)
• A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching [1.0928166738710612]
  This study addresses the challenge of identifying APT campaign attacks through system event logs. A cascading approach, name SFM, combines Technique hunting and APT campaign attribution.
  arXiv  Detail & Related papers  (2024-10-29T23:49:28Z)
• A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns [25.97800399318373]
  Multi-stage threats like advanced persistent threats (APT) pose severe risks by stealing data and destroying infrastructure. APTs use novel attack vectors and evade signature-based detection by obfuscating their network presence. This paper proposes a novel 3-phase unsupervised federated learning (FL) framework to detect APTs.
  arXiv  Detail & Related papers  (2024-06-19T03:34:41Z)
• Evaluating Robustness of Generative Search Engine on Adversarial Factual Questions [89.35345649303451]
  Generative search engines have the potential to transform how people seek information online. But generated responses from existing large language models (LLMs)-backed generative search engines may not always be accurate. Retrieval-augmented generation exacerbates safety concerns, since adversaries may successfully evade the entire system.
  arXiv  Detail & Related papers  (2024-02-25T11:22:19Z)
• User Attitudes to Content Moderation in Web Search [49.1574468325115]
  We examine the levels of support for different moderation practices applied to potentially misleading and/or potentially offensive content in web search. We find that the most supported practice is informing users about potentially misleading or offensive content, and the least supported one is the complete removal of search results. More conservative users and users with lower levels of trust in web search results are more likely to be against content moderation in web search.
  arXiv  Detail & Related papers  (2023-10-05T10:57:15Z)
• When Search Meets Recommendation: Learning Disentangled Search Representation for Recommendation [56.98380787425388]
  We propose a search-Enhanced framework for the Sequential Recommendation (SESRec) SESRec disentangling similar and dissimilar representations within S&R behaviors. Experiments on both industrial and public datasets demonstrate that SESRec consistently outperforms state-of-the-art models.
  arXiv  Detail & Related papers  (2023-05-18T09:04:50Z)
• On the Security Risks of Knowledge Graph Reasoning [71.64027889145261]
  We systematize the security threats to KGR according to the adversary's objectives, knowledge, and attack vectors. We present ROAR, a new class of attacks that instantiate a variety of such threats. We explore potential countermeasures against ROAR, including filtering of potentially poisoning knowledge and training with adversarially augmented queries.
  arXiv  Detail & Related papers  (2023-05-03T18:47:42Z)
• Signed Latent Factors for Spamming Activity Detection [1.8275108630751844]
  We propose a new attempt of utilizing signed latent factors to filter fraudulent activities. The spam-contaminated relational datasets of multiple online applications are interpreted by the unified signed network. Experiments on real-world datasets of different kinds of Web applications indicate that LFM models outperform state-of-the-art baselines in detecting spamming activities.
  arXiv  Detail & Related papers  (2022-09-28T03:39:34Z)
• Explore and Control with Adversarial Surprise [78.41972292110967]
  Reinforcement learning (RL) provides a framework for learning goal-directed policies given user-specified rewards. We propose a new unsupervised RL technique based on an adversarial game which pits two policies against each other to compete over the amount of surprise an RL agent experiences. We show that our method leads to the emergence of complex skills by exhibiting clear phase transitions.
  arXiv  Detail & Related papers  (2021-07-12T17:58:40Z)
• A Rule Mining-Based Advanced Persistent Threats Detection System [2.75264806444313]
  Advanced persistent threats (APT) are stealthy cyber-attacks aimed at stealing valuable information from target organizations. Provenance-tracking and trace mining are considered promising as they can help find causal relationships between activities and flag suspicious event sequences as they occur. We introduce an unsupervised method that exploits OS-independent features reflecting process activity to detect realistic APT-like attacks from provenance traces.
  arXiv  Detail & Related papers  (2021-05-20T22:13:13Z)
• Understanding Underground Incentivized Review Services [26.402818153734035]
  We study review fraud on e-commerce platforms through an HCI lens. We uncover sophisticated recruitment, execution, and reporting mechanisms fraudsters use to scale their operation. Countermeasures that crack down on communication channels through which these services operate are effective in combating incentivized reviews.
  arXiv  Detail & Related papers  (2021-01-20T05:30:14Z)
• Adversarial Attacks on Linear Contextual Bandits [87.08004581867537]
  Malicious agents may have incentives to attack the bandit algorithm to induce it to perform a desired behavior. We show that a malicious agent can force a linear contextual bandit algorithm to pull any desired arm $T - o(T)$ times over a horizon of $T$ steps. We also investigate the case when a malicious agent is interested in affecting the behavior of the bandit algorithm in a single context.
  arXiv  Detail & Related papers  (2020-02-10T15:04:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.