「マルチメディア，分散，協調とモバイル
(DICOMO2015)シンポジウム」 平成27年7月
f 4h[ PageRank XCB,.#jTDU
d3
œƶƓƐ1 ‰ŌØǶ2 ȇŜ¦2
R bq Web -łÉ,˜
ȈWeb @ǝ!SEh‚ijįƆż'
=ȉWeb „-SEh‚ijį(=c{ElhE\F
€‚cijį,:=ƺ÷æǁ;>=ȉǼǍÄWN|mbQ‚c-DžŐȈęĖ URL -ÊǺȈHTTP ǝ¥-ĚàDžŐ+*Ȉ
c{ElhE\F€‚cijį,Ǯǟ=ř+úƟĢũĬŖ>'
=ȉȈŹÝ-ijįúƟĢũ(.Ȉc{E
lhE\F€‚cijį@ŠƏ,ŗ¶(Ȉc{ElhE\F€‚cijį,:=FE}W-ĝŒ@ǰş=)(
'
+
)
×ȃ=ȉ(ȈŋǏķ(.ȈHTTP ǝ¥ǦƘ) PageRank @»Ž'c{ElhE\F€‚cij
į,
'»Ž>=ęĖ|\E~Nb@ǰşȈĻïĢũ:<8ŠƏ,ijį@ŗ¶=Ģũ@ĬŖȈĢũ-lj£@Ʒ
ȉ
Evaluation of the preventing method for malicious Web redirections
based on HTTP transitions and PageRank status
YUMA SATO1
1. YOSHITAKA NAKAMURA2
OSAMU TAKAHASHI2
ǚĆăëÄ=ªÒ,=ȉ
ǚĆȈWeb -łÉ,)8+$'Ȉc{ElhE\F€
ƹ 1 2013 Ćŗƌ—ƒĶĆǭ{€M€O
‚cijį,:=ƺ÷ãÁ'
=ȉc{ElhE\F€
ȁš
FE}W
•Ķ
1
JS/Redirector.ar
3328
E}W~r‚b,:=) 2013 Ćŗƌ—ƒĶĆǭ{€M€
2
Generic!atr
2571
O,
'Ȉb^m 10 -³ 7 %c{ElhE\F€‚
3
Generic Downloader.z
2152
4
JS/Exploit!JNLP.c
2092
5
JS/Exploit-Blacole.ht
1693
6
JS/Blacole-Redirect.ae
1644
7
W32/Conficker.worm!inf
1533
8
JS/Iframe.gen.k
1518
9
JS/Exploit!JNLP
1455
10
JS/Exploit-Blacole.le
1178
‚cijį. Web „@Ž'Ʒ?>=SEh‚ijį(
<ȈWeb @»Ž=y‚T- PC ,FE}W@\F€‚
c=ijį(=ȉsKkD‚Ŕĉ—ƒ-s€W|‚F
cijį($!)Ƒ'
=[1]ȉƹ 1 , 2013 Ćŗƌ—ƒ
ĶĆǭ{€M€O@ƑȉůƳ-FE}Wc{ElhE
\F€‚cijį,:$'\F€‚c>=FE}W(
=ȉsKkD‚Ŕĉ—ƒ.ȈĐ8c{ElhE\F€
‚cijįSEh‚ijį-Ʈì)+=)Šě'
=ȉ
c{ElhE\F€‚cijį.ȈijįƬŠǂ- Web
SEb@IJA'Ȉ- Web SEb@ǯDŽ!y‚T@
ijįSEb,NjûȈFE}W,ĝŒ=ȉFE}W.Ȉ
Web @»Ž=y‚T-ŸŽ=ZkbFGC-ƯČĖ
@»ŽȈ\F€‚c>=ȉFE}W-\F€‚
c.ȈƗøƼ(Ʒ?>=!7Ȉy‚TŤ‘).Ǽ
ȉ-:+c{ElhE\F€‚cijį,.ȈWN
|mbQ‚c»Ž>=ȉc{ElhE\F€‚cij
į,»Ž>=WN|mbQ‚c.ȈijįƬ,:$'ǼǍ
Ä>'
'ȈijįDžŐƬơÆ,DžŐ(+
:,Ƥ
Ă'=ȉ-:,c{ElhE\F€‚cijį.
1 ±Ɯ."'ŊŎçðçðDzUW`uĚàƖðƎƚƖ Graduate School of Systems Information Science, Future University Hakodate
2 ±Ɯ."'ŊŎçðUW`uĚàƖðǨ School of Systems Information Science, Future University Hakodate c{ElhE\F€‚cijį-úƟ)'ȈǼǍÄW
N|mbQ‚c-DžŐȈęĖ URL -ÊǺȈHTTP ǝ¥-Ě
àDžŐ+*Ȉř+úƟĢũĬŖ>'
=ȉ,8
?;Ȉ¢űc{ElhE\F€‚cijį,:=Ȉs}
FGC-ĝŒàÔ>'
=ȉc{ElhE\F€‚
cijį. Web SEb-IJA,:$'Ċǒ>=ȉ
Web SEb-IJA@Ǭňǭŗ¶(+
áÏȈc{El
― 927 ―
hE\F€‚cijį-Ɔǁǡ>=áÏƫ;>=ȉ
(ŋƎƚ(.ȈN{EC€b(=y‚T Web SE
2.2 HTTP )
b,CNYW![Et€O(c{ElhE\F€‚c
c{ElhE\F€‚cijį. Web @Ž'+>
ijį-ƅ
-= Web o‚V@ŗ¶Ȉc{ElhE\F
=ȉWeb „- HTTP ǝ¥,. HTTP v^Y‚V»Ž>
€‚cijį-ǰş@ĻïĢũ:<ȇƢĈ,ƷĢũ-Ĭ
'<ȈN{EC€b;S‚h1-ǀť(= HTTP |
Ŗ@Ʒȉ
NHWb)S‚h;N{EC€b1-ĕƞ(= HTTP
~Wr€W- 2 %;Ġ<Ɯ%[3]ȉHTTP |NHWb,.Ȉ
2. I H D U E a
ǀť= Web o‚V URI Ěà8Ó4>=ȉHTTP ~Wr€
2.1 $ + ' % 0 / 1 $ I H I H & / 1
W,.ȈHTTP ǝ¥-ŴĞ@ƑW`‚[WQ‚cÓ4
c{ElhE\F€‚cijį.Ȉs}FGCĝŒijį
>=ȉ
-ƒƙ(=ȉy‚T Web SEb@CNYW!ǸȈy
HTTP |NHWb-n^\,.ȈN{EC€b,Ǯ=
‚T-ĜÛ,Ǯ?;Ȉy‚T,ęĜ=ZkbFGC@
ĚàÓ4>=ȉHTTP ~Wr€W-n^\,.ȈS‚h
\F€‚c=[2]ȉ
,Ǯ=ĚàȈQ€`€_-ĚàÓ4>=ȉǀťn^\
-i{v‚[)'Ȉǀť¬-pWb@Ƒ HostȈHTTP
|NHWb-Ɔż«@ÈŲ= Referer +*Ó4>=ȉ
ĕƞn^\-i{v‚[)'ȈN{EC€bËđ=
Q€`€_-Þ@Ƒ Content-TypeȈǀť= Web o‚V
- URL “å- Web o‚V@Ĭ¡=!7,»Ž>=
Location +*Ó4>=ȉReferer . HTTP |NHWb-Ɔ
ż«-Ěà@Ó6ȉ>,:< Referer -Ěà;ȈN{
EC€b- Web o‚V-ǦƘ?=áÏ=ȉy‚T
-§ŒĚà Referer ,Ó4>=áÏ+*-y‚T-m{
EhU‚ñ;>+
áÏȈRFC2068 (.ȈReferer @ HTTP
n^\,‘Á+
)īé>'
=ȉ
2.3 I H 7 X E a
2.3.1 &01(,0!0
ǚĆ-c{ElhE\F€‚cijį(.ȈkD€L‚
m|€`D€O»Ž>'
=[4]ȉkD€L‚m|€`
D€O).ȈS‚h(= Web SEb Web SEb,C
NYW!N{EC€bŻâ@ǐº=Ģũ(=ȉƒƱ
Û 1 c{ElhE\F€‚cijį-k‚
Ƈ,Ȉy‚T-ŸŽ=Żâ,Ï?!Q€`€_@Ĭ¡
=!7,ŸŽ>=8-(=Ȉc{ElhE\F€
c{ElhE\F€‚cijį-²ÞƇ+k‚.Û
‚cijįƬ. JavaScript @»Ž'Ȉy‚T-ŸŽ=
1 -:,+$'
=ȉijįƬ.ȈŠǂ Web SEb- Web
l{FT9m{OE€-ŻâĚà@ËđȈ-ŻâĚà
o‚V;ijįƬŽĜ=ijį Web SEb1-|\E
@8),|\E~Nb¬ URL @äŃ=ijį@Ʒȉijį
~Nb@ƉƇ)'ȈŠǂ Web SEb-o‚V@IJA
Ƭ.Ȉ-kD€L‚m|€`D€O,:$'Ȉijį-Ġ
=ȉIJA>! Web o‚V,CNYW!y‚T.Ȉij
ÀŸ@҄'
=ȉ
įƬIJA,:$'Ī!|\E~Nb,:<Ȉijį
ƬŽĜ!ijįSEb1Njû;>=ȉƒƱ,c{E
2.3.2 me8,(#1$
lhE\F€‚cijį,=-|\E~Nb.ƾĶ
c{ElhE\F€‚cijį(.ȈÛ 2 -:+ǼǍ
ïÝ=)æ
ȉ|\E~NbƾĶ=źſ.Ȉij
Ä>!WN|mbQ‚c@»Ž=8-=ȉijįƬ
įƬijįŗ¶@Ùǧ=
.ÚǼ,=!7)ƫ;
.ȈWN|mbQ‚c³-ķî¸-ƨĭ+*ǼǍÄ@
=ȉijįSEb(.Ȉy‚T-ŸŽ= OSȈl{FTȈ
ĺȈijįDžŐ@=Ɲ 3 Ƭ,WN|mbQ‚c-ĩÃ@
l{FT-CcJ€-ƯČĖ@ƛijįƷ?>Ȉy‚T
ơÆ,DžŐ(+
:,'
=ȉ
-¼ĒijįƬ,ê?>=ȉ-ĐȈy‚T.s}FGC
ǩąSEb1Njû>ȈęĜ=ZkbFGC@\F€
‚c;>=ȉ
― 928 ―
=[7]ȉ|\E~Nb-ū.Ȉl{FT,:=kBE}
-ưÃǍ5ǘ59|\E~Nb,ú=Ĩś(<Ȉ|\
E~Nb-šĶ)õƪ'
=ȉ–Ĝ- Web o‚V-šĶ
Û 2 ǼǍÄWN|mbQ‚c- @ 1 )=ȉ- Web o‚VǍ5ǘ6 Web o‚V-š
Ķ@ 2 )=ȉWeb o‚V-šĶ 2 -Ǎ5ǘ6 Web o
‚V-šĶ@ 3 )=ȉ3 š“„ū
šĶ8Ðř,KF€
3. i g Z \
b=ȉ|\E~Nb,:=ǝ¥.ȈšĶã3*Ɲ 3
3.1 m e 8 , ( # 1 $ c N
Ƭ-Q€`€_Ó4>ȈWeb o‚V,ú=¥ȂĈ›
ǼǍÄWN|mbQ‚c-DžŐĢũ.ȈǽƇ,Q‚c@
+=)”õ'
=ȉ4!Ȉ|\E~Nb-ū.ȈƄ
DžŐ=Ĺũ)Q‚c@öƷ=),:$'DžŐ=
+=cvE€Ñ1-|€NǕ-šĶ)õƪ'
=ȉy
Ĺũ- 2 %=ȉ
‚TCNYW! Web SEb-cvE€)Ƅ+=áÏ
ƔƵ;. JavaScript -Q‚c@ı™Ƈ+Żâ(öƷ=
9ć-šĶã3*Ȉ|\E~Nb-ūÐř, Web
),:<ǼǍÄWN|mbQ‚c@DžŐ=Ģũ@ĬŖ
o‚V,ú=¥ȂĈ›+=)”õ'
=ȉòƶ;
'
=[5]ȉǼǍÄWN|mbQ‚c-öƷŻâ@ƈǃ
.Ȉ HTTP |NHWbȈHTTP ~Wr€W-ƈǃȈËđȈ
+;ȈJavaScript -ǮĶ eval @ŸŽ=)(ǼǍÄ@
n^\-‘Á@Ʒ
Ȉy‚T-ݞ,:=ǝ¥)l{FT
Dždz!WN|mb@Ħ¶=Ĺũ(=ȉ
,:=ưÃǝ¥@ź'
=ȉy‚TN|^N!
4!ȈƔƵ;.ÃƇDžŐ"(.ȈJavaScript -ĩÃ@
URL - HTTP |NHWb- HTTP n^\,X-Action: 1;
2'DžŐ=).(+
)'ȈĦǑŘķDžŐʼn@Ž
Clickn^\@‘Á=ȉl{FTưÃ(Ɔż= HTTP
'ȈWN|mbQ‚cư(.+ȈWN|mbQ‚c
|NHWb,. X-Action: [2,3,4,]; Auto n^\@‘Á
-ĩÃ@DžŐ=Ĺũ@ĬŖ'
=[6]ȉ-Ĺũ.Ȉ
=ȉƝ 2 þ-áÏ. X-Action:1; Auto )+=ȉ|\E~N
JavaScript Q‚c,Ó4>=ǮĶÑ9ĊĶ-¨Ƅ+$'
b - ū Ȉ š Ķ @ K F € b = Ĺ ũ . Ȉ Referer Ě à )
'8ȈJavaScript ŘǞ@ĥĮ=)(=ȉÐijį
Location Ěà@»Ž=ȉHTTP |NHWb,%
'ȈHTTP
i[‚€- JavaScript -ŘķDžŐʼn.¯'ÐŘǞ(.+
n^\, Referer ïÝ!áÏȈX-Action n^\-¨, 1
Ȉ™!ŘǞ@'
=-(Ȉ>@»Ž JavaScript
@ǔȉ4!ȈHTTP ~Wr€W,%
'ȈLocation Ěà
Q‚c@ęĖ)5+ȉ%4<ȈĦǑŘķDžŐʼn@UOf
ïÝ!áÏ,.ȈX-Action n^\-¨, 1 @ǔȉ
]w)'ęĖ-ǼǍÄ>! JavaScript Q‚c@ǁ%
> @ HTTP ǝ ¥ - Ʒ ? > = Ǹ , Ȉ µ ź @ Ʒ $ ' ȉ
=Ģũ(=ȉ
X-Action n^\-¨ 4 “„($!áÏȈǝ¥@ęĖ)
5+Ȉǝ¥ǥĸ=ȉ4!ȈContent-Type application/pdf
3.2 C B URL : l
(ȈX-Action n^\-¨ 0 (+
áÏȈContent-Type Web N‚{,:= Web āÙ@Ʒ),:<ȈęĖ
application/octet-stream
Ȉ
application/x-download
Ȉ
URL @ÊǺl{^N|Wb(ęĖ Web o‚V-ǝ¥@
application/x-msdownloadȈapplication/x-msdos-program -
ǥĸ=Ģũ=ȉ
>(y‚TĢÃ(CNYW! Web o‚V-cv
l{^N|Wb-žĠ,.ȈßŋƇ, 3 %-µźƷ?
E€Ñ)|\E~Nb¬-cvE€ÑƄ+=áÏȈƆż
>=ȉ4ęĖ)ƫ;>= URL @ÊǺ=ȉÊǺ,.Ȉ
=ǝ¥@ęĖ)5+Ȉǝ¥ǥĸ=)(c{Elh
Web N‚{@Ž
'ȈWeb o‚V,Ó4>=|€N@Ǚ
E\F€‚cijį-ijįŗƌ=Ģũ=ȉ
<ȈURL @ÊǺ=ȉŞ,Ȉ- URL ,ú'kD}[
@»ŽȈDžŐƬöǸ, Web o‚V,CNYW HTMLȈ
3.4 i g Z \ ; o V
JavaScript -Q‚c@lj£ȈŰĶ@%=ȉ-ŰĶ@Ž
ǼǍÄWN|mbQ‚c-DžŐ.Ȉijį)5+>=i
'ȈWeb o‚VęĖ(=*¹ĸȈl{^N
[‚€ïÝ>/Ȉijį@ŗƌ(=ȉȈŊƌ-
|Wb@žĠ=ȉ
ǼǍÄWN|mbQ‚ci[‚€,úĕ(+
áÏ,ij
į@ŠƏ,ŗƌ(+
)
×ȃ=ȉ
3.3 HTTP )
cN
l{^N|Wb.ȈęĖ URL @ÊǺȈǩą=)(Ȉ
HTTP n^\ȈIP Cc~WȈcvE€Ěà@»Ž'Ȉ
ęĖ Web o‚V(=*¹ĸ=ȉȈc{E
ęĖ)ƫ;= HTTP ǝ¥@ŗƌȈijį@ǰĢũ
lhE\F€‚cijį(.ȈkD€L‚m|€`D€O
=ȉ
»Ž>=ȉkD€L‚m|€`D€O,:$'ȈÊǺ
òƶ;. Web o‚V,Ó4>=|\E~Nb-ūȈć
>=ęĖ URL . Web N‚{-l{FTȈm{OE€
<@Ĩś)Ȉc{ElhE\F€‚cijį-ęĖ
,ŇÂ+ijį@Ó6ęĖ URL ÊǺ=)(+
Web o‚V)-ǝ¥@ǥĸȈijį@ǰĢũ@ĬŖ'
ȉęĖ URL -ÊǺ"(.Ȉc{ElhE\F€‚c
― 929 ―
V C . Web o‚V D 1-|\E~NbƆż=)”õ
ijį@ǰ)(=).dž+
ȉ
4!ȈŹÝ- HTTP n^\DžŐĢũ.Ȉ|\E~Nb,
=ȉy‚T-l{FT C @Ǎ5ǘA"ǸȈC - HTTP
:$'Ëđ>=kBE}ƲĖ($'8Ȉnjŗƌ,:
~Wr€W,.º- Web o‚V D - URL Ljǖ>'
$'FE}W-\F€‚cĊǒ=áÏ=)
<Ȉl{FT. D @ưÃ(Ǎ5ǘ6ȉLocation .Ȉǀť-
×ȃïÝ=ȉ4!ȈšĶ›
ęĖ-ǝ¥@ǥĸ(
ĕƞ(= HTTP ~Wr€W,‘Á>=Ěà(=ȉ
+
áÏƆż=áÏ<ȈŠƏ,ijįŗ¶=
4.2 PageRank
)('
+
)
×ȃ=ȉ
PageRank .Ȉ=Ǐķ-ǪǀĖ.-Ǐķ;-ĊŽĶ
,:$'lj£>=)
ðƸǏķ-ƫ@ Web ,ǤŽ
4. G P D U
!8-(=[8]ȉǏķ-ǪǀĈ.ȈƺĊŽĶ(ŧ4<Ȉ
4.1 Web k ?
PageRank .ƺ|€NĶďǿ=ȉPageRank -C}R|
Web Ƿþ).Ȉ–Ĝ- Web o‚V|\E~Nb,:
$'Ǎ5ǘ6 Web o‚V-ŘǞ)õƪ=ȉ
Xu.Ȉ
–Ĝ- Web o‚V A - PageRank . Web o‚V
A ,|€N'
=Îo‚V- PageRank @Ȉ-o‚V
–Ĝ- Web o‚V-Ƿþ@ 1 )=ȉ- Web o‚V
;-åÒ-|€NĶ(¾$!¨-ƧÖ)'õƪ
Ǎ5ǘ6 Web o‚V-Ƿþ@ 2 )=ȉWeb o‚V-
>=ȉ PageRank . Google ;ǁ! Web o‚V-ǪǀĈ
Ƿþ 2 -Ǎ5ǘ6 Web o‚V-Ƿþ@ 3 )=ȉ3 þ“
(<Ȉ0 ; 10 - 11 šǷ({€N‘>=ȉ PageRank
„ū
Ƿþ8Ðř,Ƿþ@KF€b=ȉ
-¨ȇ>/ȇ
3*ȈGoogle ;ǁ! Web o‚V-
Web Ƿþ@ʼnŘǞ(ƹ)Û 3 -:,+=ȉǷþ 1
ǪǀĈ.ȇ
)>=ȉGoogle .ȈưÃÄ>!mO{
- Web o‚V@ʼnŘǞ-ŕ)=ȉǷþ 1 - Web o‚V
u+*,:$'Ȉ|€N@žĠ=+*Ȉ†ưű+|€N
Ǎ5ǘ6Ƿþ 2 - Web o‚V.Ȉŕ-í)+=ȉ
, % ' o d } ` D @ ‡ = á Ï 8 = ȉ Google . Ȉ
PageRank @„=,.ȈE€[‚f^bQtxe`D(ư
ű,ŒŤ@ŷđ=)ȈǮǟĖ-ȇ
ŵư-Q€`€_
@žĠ=))Ǜ2'
=ȉŋƎƚ(.Ȉ- PageRank
@»ŽȈy‚TCNYW= Web o‚V-¥ȂĈ-0
)%-Ĩś)=ȉ
4.3 G P - , *
HTTP ǝ¥- Web Ƿþ) PageRank @Ž
'c{Elh
E\F€‚cijį,:=ęĖ|\E~Nb@ǰş=ȉ
HTTP ǝ¥-ǝ¥ǦƘ@»ŽȈWeb o‚V- Web Ƿþ@
KF€b=ȉō•@ŭ! HTTP ǝ¥-Ěà)ȈPageRank
@»ŽȈǝ¥ęĖ|\E~Nb*@¹º=ȉ
y‚T-N|^N4!. URL h‚,®¿! Web o‚
Û 3 Web Ƿþ
V-Ƿþ@ 1 )Ȉ- Web o‚VǍ5ǘ6 Web o‚
V-Ƿþ@ RefererȈLocation @»Ž'ȈWeb Ƿþ@KF
€b=ȉǷþ 4 “„-ǝ¥,ú'Ȉ|NHWb URL
Web Ƿþ.ȈHTTP n^\- RefererȈLocation @»Ž
'ȈKF€b=ȉ
-ó¯¦ȅcvE€Ñ FQDN - PageRank @Ëđ=ȉ
PageRank 0 4!.ȈïÝ+
áÏ.ȈęĖ|\E~N
Referer .Ȉ–Ĝ- Web o‚V-ǦƘ«@¤ħ=Ěà
b)5+Ȉǝ¥@ǥĸ=ȉ4!ȈHTTP n^\.ń
(=ȉ–Ĝ- Web o‚V A ïÝȈA . Web o‚V
ĭÌƭ+-(ȈReferer ïÝ+
áÏ8=ȉ-
B @Ǎ5ǘ6)”õ=ȉy‚T-l{FT A @Ǎ5ǘ
).Ȉ|NHWb URL ,Ó4>= FQDN - PageRank @
A"ǸȈ B @Ëđ=!7Ȉl{FT.Ȉǀť(= HTTP
ËđȈPageRank 0 4!.ïÝ+
áÏ.Ðř,ęĖ
|NHWb@ B ,Ʒȉ-ǸȈB -Ǎ5ǘ5,ƤĂ+
|\E~Nb)5+ȉ;,Ƿþ 2 “„( Content-Type
>/ȈB - HTTP |NHWb-n^\, B . A ;Ɔż
application/pdf - Web o‚VȈWeb l{FTưÃ(Ǎ
!ǝ¥(=)
Ěà‘Á>=ȉ-‘Á>!
5ǘ6 Web o‚V- Content-Type application/octet-streamȈ
Ěà Referer (=ȉ
application/x-download
Ȉ
application/x-msdownload
Ȉ
Location .Ȉ–Ĝ- Web o‚V@Ǎ5ǘA"ǸȈº-
application/x-msdos-program -
>(ȈǷþ 1 - FQDN
URL -Ǎ5ǘ5@Ւ=Ěà(=ȉ–Ĝ- Web o‚
)|\E~Nb¬- FQDN Ƅ+=áÏ|\E~Nb¬-
― 930 ―
FQDN - PageRank @ËđȈęĖ|\E~Nb-¹º@
c{ElhE\F€‚cijį-ijįǝ¥a‚[)āÙ
ƷȉķŶ[9]:<ęĖ Web SEb-żïňǭ. 1 ļ-8
URL -|WbȈc{ElhE\F€‚cijį,:$'N
-æ
)?$'
=ȉżïňǭƍ
Web SEb,
{EC€b,\F€‚c>!öƷĎĉkBE}-s}
PageRank .ïÝ+
!7ȈGoogle ,lj£>'+
@ę
FGC-g^Ux¨Ȉs}FGCS€cq^NW„(öƷ
Ė Web SEb)ǁ+Ȉ>;- Web SEb)-ǝ¥@
!Ǹ-s}FGCǝ¥a‚[Ó4>=ȉŋöȆ(.Ȉ
ǥĸ=)(ęĖ|\E~Nb@ǰȉ
ęĖ URL @āÙ'đ;>!c{ElhE\F€‚c
ijį-ijįǝ¥a‚[)āÙ URL -|Wb@öȆúǑ)
=ȉ
5. < p " 1 < p K U
ijįǝ¥a‚[.Ȉge‚r^b-ǝ¥@ tcpdump (i
5.1 < p R b
P^bMwm]w! PCAP Ďĉ-kBE}(=ȉ-
öȆ.ȈöǸ,Ʒ?>! HTTP ǝ¥@´ŹȈijįŗ¶
kBE}@ęĖǝ¥a‚[)ȈD3M2010 @dz
!a‚[
-ƢĈ@Ŭ=ȉĬŖĢũȈ-ŗƌȀƉ@ä!Ģũ@
@ŋöȆ(ŸŽ=śŋ)=ȉ4!Ȉ āÙ(ijį@ŗ¶
ǤŽȈöȆ@Ʒȉ
! URL @öȆ(ŸŽ=ȉ
5.2 < p " 1 5.3 S M " 1 F 5
5.2.1 `Bf4"1
śŋ)+=öȆa‚[,. HTTP n^\“å-ǻǾ)+
Alexa Internet, Inc .ȈWeb SEb-CNYWĶ-ǎœ9
=ǝ¥Ó4>=ȉ(śŋ-öȆa‚[; HTTP |
ƦLJ@)$'
=ȉAlexa (.ȈˆƁȈܺ-K`R|(
NHWb) HTTP ~Wr€W-iP^b@Ħ¶ȈĦ¶
>
>CNYWĶȇ
Web SEb„š 500 •-{€M
€O@±ƹ'
=[10]ȉ4!ȈWeb Q€`€_-K`R
|º(Ȉ>
>-CNYWĶȇ
Web SEbŅ焚
500 •@±ƹ'
=ȉ
!ÎiP^b;k~‚uƃÍȈHTTP |NHWbk{OȈ
HTTP ~Wr€Wk{OȈǜ¥«r‚bƃÍȈǜ¥¬r‚
bƃÍȈHTTP n^\- HOST ĚàȈRefererȈLocationȈ
Content-TypeȈ|NHWb URI @Ħ¶!ȉ
ŋƎƚ(.ȈAlexa ±ƹ=ˆƁ-CNYW{€M€
Ob^m- Web SEb@öȆúǑ)=ȉˆƁ-CNYW
5.4 < p K U
{€M€O. Alexa ; 2015 Ć 4 ņ 16 ļ,ËđȈHTTP
ǝ¥@Ʒ Web SEb 100 •@öȆúǑ)=ȉ
öȆ.śŋ(=öȆa‚[;iP^bĚàȈHTTP
n^\Ěà@Ħ¶!`MWbkBE}@ŸŽ=ȉƒƱ
ŋöȆ(.ȈHTTP ǝ¥@Ʒ Web SEb 100 •- URL
Ƈ,y‚T. Web l{FT(|€N@N|^NȈURL h
@āÙ'đ;>!ǝ¥a‚[@ƲĖǝ¥a‚[)Ȉŋ
‚, URL @ģ#ȈWeb o‚V1CNYW=ȉ-Þ
öȆ(ŸŽ=śŋ)=ȉöȆúǑ- HTTP ǝ¥@Ʒ
@´Ź=!7,ȈŋöȆ(.ȈöȆa‚[-Ëđ-ǸȈ
Web SEb 100 •.ȈˆƁ-CNYW{€M€Ob^m 500
āÙ! URL -`MWbkBE}@ŸŽ=ȉ2 ƙȄ-`
š“³,{€NE€'
=ȈĔ8ƲĖǝ¥@Ʒ
MWbkBE}@Ǎ5ǘ5ȈĬŖĢũ+*-lj£Ģũ@Ǥ
).DZ;+
ȉȈŋöȆ(.ȈƲĖǝ¥a‚[-ś
Ž=ȉ
ŋ)'õƪ=ȉ4! HTTP ǝ¥@Ʒ Web SEb 100
•- URL @öȆ(ŸŽ=ȉ
5.5 < p n Y
N‚{( Web SEb,CNYWȈtcpdump (ƲĖǝ
öȆ-ŗƌȀƉ.“…-ǝ<(=ȉ
¥a‚[@ÊǺ!ȉ
I.
Ƿþ 3Ȉ4 4!.Ȉ5 “„- Web o‚V
II. Ƿþ 2 “„( Content-Type application/pdf - Web
5.2.2 CBf4"1
o‚V
NTT YMxCm{^bkI‚uƎƚġ.Ȉ2010 Ć;
III. Web l { F T ư à ( Ǎ 5 ǘ 6 Web o ‚ V -
Web N{EC€bÞge‚r^b@ŸŽȈc{ElhE
Content-Type
\F€‚cijį,Ǯǟ=a‚[@ÊǺ'
=[11]ȉ
application/x-downloadȈapplication/x-msdownloadȈ
ĝŒĢũ-ŗƌȈDžŐĤƸ-Ǝƚ-!7,c{ElhE\
application/x-msdos-program -
>(ȈǷþ 1
F€‚cijį,Ǯ=a‚[ D3M(Drive-by Download
application/octet-stream
Ȉ
- FQDN )|\E~Nb¬- FQDN Ƅ+=áÏ
Data by Marionette)2014 a‚[Y^b@ƎƚŝǮ,Ĭ¡
IV. Web o‚V-Ɔż«†Ľ+áÏ
'
=ȉ D3M2014 a‚[Y^b,.ǢÇ,ÊǺ!ǝ¥
>-ō•,č'.4=áÏȈPageRank @ËđȈ
a‚[Y^b D3M2010ȈD3M2011ȈD3M2012ȈD3M2013
ijį*@¹ĸ=ȉŋǏķ(.ȈŗƌȀƉ@äŃȈ
-a‚[Y^bÓ4>=ȉ
9 %-öȆ@Ʒ+$!ȉ
D3M a‚[Y^b,.ȈęĖ URL @āÙ'đ;>!
― 931 ―
I -ŗƌȀƉ,%
'Ȉŗƌ=Ƿþ-Ķ@äÄ=
,:$'ijįŗ¶Ÿ,Ąǁ;>=)ƫ;>=ȉ(Ȉ
4!¯-ijįŗ¶Ÿ)'Ȉ(5)-LJƠĉ@Ž
=ȉ
Ƿþ@ 3Ȉ4Ȉ5 ,!áÏȈ*-:+ƥő,+=!7,
öȆ@Ʒ+$!ȉ4!ȈĻïĢũ(.ȈŽ
;>+
IV
-ǤŽȈPageRank @ǤŽ=)(Ȉ*-:,ŗƌƥő
ä?=-@öȆ@Ʒ+$!ȉ
5.5.1 k?6
<p
ĬŖĢũ I -ǷþĶ 3Ȉ4 4!. 5 ,'öȆ@Ʒ+$!ȉ
;,>
> - Ƿ þ Ķ ( Ȉ IV @ Ǥ Ž + á Ï Ȉ
¯-ijįŗ¶Ÿ
. 4 ) $ + . 3 ) $ +
(5)
. 4 ) & 3 ) . 3 ) & 4 ) $ +
6. < p ^ O _ =
6.1 < p ^ O
öȆƥő@Û 4~6 ,ƑȉĬŖĢũ(=öȆ 4 -¯
PageRank @ǤŽ+
áÏ-öȆ@Ʒ+$!ȉ
-ijįŗ¶Ÿ 96.28%)Ņ8ȇ
ƥő)+$!ȉǮǟĢũ
(= HTTP n^\DžŐ-ĻïĢũ.ȈƊǵĖŸ.Ȉ99.21%Ȉ
5.6 d 3 K U
ƊǵĖŸȈ©ǴĖŸȈƊǴĖŸȈ©ǵĖŸȈ¯-ijį
ƊǴĖŸ.Ȉ77.03%Ȉ¯-ijįŗ¶Ÿ. 96.23%($!ȉ
ŗ¶Ÿ- 5 %-lj£ȀƉ,:$'ÎĢũ@lj£=.
ęĖǝ¥a‚[.Y^Uz€Æš(lj£@Ʒȉ(
-Y^Uz€).Ȉy‚T–Ĝ- 1 •- URL ,CNYW
6.2 _ =
6.2.1 GPDU
Q5]@
!Ǹ,Ʒ?>=ǝ¥@ĨȉŋƎƚ(.ȈCNYWŀǭ
ĬŖĢũ.ȈǮǟĢũ(= HTTP n^\DžŐ-ĻïĢ
@ƫğȈ= Web SEb1- 1 Ù-CNYW@ 1 Y^
ũ:<8ȈƊǵĖŸ.Ȉ0.05 rE€bȈƊǴĖŸ.Ȉ18.60
Uz€)=ȉƊǵĖŸ.ȈijįƆż!Y^Uz€,
rE€bȈ¯-ijįŗ¶Ÿ. 0.05 rE€b„Ù$!ȉ?
|\E~Nb¬-ijį@Ŋű,ǰ
"áÏ-¾Ï(=ȉ
(.=ȈPageRank @ǤŽ!áÏ-ĹĻïĢũ
(1)-LJƠĉ(ƊǵĖŸ@lj£=ȉ
:<8ȈŠƏ,ŗ¶('
=ȉ-);ƲĖa‚[
,Ǯ'.ȈPageRank .Ǫǀ+ijįŗƌȀƉ(=)ƫ
;>=ȉ
ƊǵĖŸ
!
#,-2$+
Û 46 ;ƊǵĖŸ,%
'ȈöȆ 1Ȉ3Ȉ4Ȉ6Ȉ7Ȉ9
(1)
ȇ
)?=ȉ>;-öȆ(.Ȉ|\E~Nb(
*)1%#(+
Ɔż=Ɔż«†Ľ+ Web o‚V@ęĖ)5+ĢũȈ
©ǴĖŸ.ȈijįƆż!Y^Uz€,ú'Ȉ|\E
|\E~Nb(Ɔż=Ɔż«†Ľ+ Web o‚V-
~Nb¬-ijį@ǰ+$!áÏ-¾Ï(=ȉ(2)-LJ
PageRank @Ëđ'ijį*¹º=Ģũ@ǤŽ
Ơĉ(©ǴĖŸ@lj£=ȉ
'
=ȉƆż«†Ľ+ Web o‚V@ęĖ)5+)(Ȉ
c{ElhE\F€‚cijį,ú'ȇ
ŗ¶Ÿ@ǣĠ
('
=ȉöȆ 1Ȉ3Ȉ4Ȉ6Ȉ7Ȉ9 .2' IV @ǤŽ
©ǴĖŸ
!
#$+
(2)
'
=ȉIV @ǤŽ'
+
öȆ 2Ȉ5Ȉ8 )ţ2Ȉȇ
Ɗ
ǵĖŸ@ǣĠ('
=ȉ:$' Referer ïÝ+
Ɔ
*)1%#(+
ż«†Ľ+ Web o‚V@ęĖ*¹º=)(
ƲĖǝ¥a‚[. Web o‚V),lj£@ƷȉƊǴĖŸ
ȇ
ƊǵĖǣĠ(=)ƫ;=ȉ
öȆ 1Ȉ3 (.ȈęĖ|\E~Nb)5+)(Ȉæ
.ȈƲĖ Web o‚V@ƲĖ Web o‚V)5+!áÏ(
-ęĖ|\E~Nb@ęĖ)5+)(!ȉ 4!Ȉ
=ȉ(3)-LJƠĉ(ƊǴĖŸ@lj£=ȉ
HTTP ǝ¥,
'ȈRefererȈLocation ( Web Ƿþ-Ɔż
«†Ľ+ Web o‚V-|NHWb URL - FQDN -
ƊǴĖŸ
0 ) # 0 ) $ +
(3)
PageRank @ËđȈęĖ|\E~Nb@ŗƌ=)(ę
Ė|\E~Nb-ŗƌŸȇ
ƥő,+$!)ƫ;>=ȉ
0 ) 1 % " ! / ' +
ƲĖa‚[,Ǯ'ȈƊǴĖŸöȆ 49 ,ţ2›+$
©ǵĖŸ.ȈƲĖ Web o‚V@ęĖ|\E~Nb)5
'
=ȉæ-ƲĖ Web o‚V@ęĖ)ǁ+'
=ȉ
PageRank @ŗƌȀƉ)!áÏ.ȈƲĖa‚[,Ó4>=
+!áÏ(=ȉ(4)-LJƠĉ(©ǵĖŸ@lj£=
b^mSEb(8ȈPageRank 0 4!.ȈïÝ+
Web
SEb; Web o‚V@Ǎ5ǘ6áÏ=;(=
©ǵĖŸ
0 ) # * ) $ +
0 ) 1 % " ! / ' +
(4)
)ƫ;>=ȉ-ŹǑ.ȈǷþº(+'8 PageRank
@ŗƌȀƉ)=)-ŹǑǁ;>=ȉ
― 932 ―
öȆ 4Ȉ6 (.Ȉæ-ęĖ|\E~Nb@ęĖ)5+
)(!ȉ
öȆ 7Ȉ9 ,ǮȈÐřȈæ-ęĖ|\E~Nb@ę
Ė)5+)(!ȉ
7. 7.1 ŋƎƚ(.ȈWeb @ǝ!s}FGCĝŒijį(=c
{ElhE\F€‚cijįúƟ-ĻïĢũ:<8ŠƏ,
IV @ǤŽ=)(Ȉȇ
ƊǵĖŸǣĠ(=)
?$!ȉ4!ȈPageRank @ǤŽ=)(Ȉ¯-ijį
ŗ¶Ÿ 96.28%)Ņ8ȇ
ŗ¶Ÿ@ǣĠ'
=ȉ:$'Ȉ
ĬŖĢũ.ŇÂ(=)ƫ;=ȉ
ijį@ŗƌ=)@ƉƇ)!ȉ-ƉƇ@ǣĠ=!
7, HTTP n^\; Web o‚V- Web ǷþȈWeb o‚
V-ǝ¥ǦƘ@Ľ;,'ȈPageRank @Ž
=)(ę
Ė|\E~Nb-ǰş@ƷĢũ@ĬŖ!ȉ4!ȈĢũ-lj£@Ʒ$!ȉ-lj£)'ȈReferer ïÝ+
Ɔż«†Ľ+ Web o‚V@ęĖ*¹º=
öȆ1Ȉ2Ȉ3-ŗ¶Ÿ
100.00%
95.64%
98.27%
99.26% 96.28% 99.21%96.23%
95.33%
95.93%
77.03%
)(Ȉȇ
ijįŗƌŸđ;>!ȉ-ƥő;ĬŖĢũ
.Ȉc{ElhE\F€‚cijįúƟ)'ĻïĢũ:
<8ŇÂ+úƟĢũ(=)ƏNJ(!ȉ4!ȈĬŖ
50.00%
Ģũ-ŗƌȀƉ@äÄ=),:$'Ȉijįŗ¶,Ň
Â+ȀƉ*@ǎœ=)(!ȉ
0.00%
öȆ1
ƊǵĖŸ
öȆ2
ƊǴĖŸ
öȆ3
7.2 2 A > L
¯-ijįŗ¶Ÿ
ŋƎƚ,:<ȈWeb o‚V-ǝ¥ǦƘ@Ľ;,=
)(Ȉc{ElhE\F€‚cijį-ęĖ|\E~Nb
Û 4 öȆ 1Ȉ2Ȉ3 -ŗ¶Ÿ
@ǰȈĻïĢũ:<8ŠƏ,ijį@ŗƌ=)(
!ȈPageRank ęĖa‚[,ú'çŇÂƇ(=
).dž+
ƥő)+$!ȉĐ. PageRank (.+
ŗ
öȆ4Ȉ5Ȉ6-ŗ¶Ÿ
100.00%
95.64%
96.23%
98.27%
99.26% 96.28% 99.21%
95.33%
96.22%
77.03%
50.00%
ƌȀƉ@»ŽȈs}FGC-\F€‚c@ǰĢũ@
ĬŖ!
)ƫ'
=ȉ
9_JW
0.00%
öȆ4
ƊǵĖŸ
öȆ5
ƊǴĖŸ
öȆ6
¯-ijįŗ¶Ÿ
Û 5 öȆ 4Ȉ5Ȉ6 -ŗ¶Ÿ
öȆ7Ȉ8Ȉ9-ŗ¶Ÿ
98.27%
98.27% 95.33% 99.21% 96.23%
95.33%
96.22%
100.00%
77.03%
96.22%
50.00%
0.00%
öȆ7
ƊǵĖŸ
öȆ8
ƊǴĖŸ
öȆ9
¯-ijįŗ¶Ÿ
Û 6 öȆ 7Ȉ8Ȉ9 -ŗ¶Ÿ
[1] sKkD‚Ŕĉ—ƒ, "s€W|‚ FE}W~r‚b | YM
x|`DĚà", http://www.mcafee.com/jp/threat-center/monthly/i
ndex.aspx
[2] IPA ŵƜƷĴũŒ ĚàµźīǠŝŘ, "Q€jx‚[FE}
W†ŠCNYW-ý¶ŴŨ[2010 Ć 11 ņ·],%
'", https:
//www.ipa.go.jp/security/txt/2010/12outline.html
[3] "RFC INDEX", http://www.rfc-editor.org/rfc-index.html
[4] C.Kolbitsch, B.Livshits, B.Zorn, C.Seifert, "Rozzle: De-cloaking
Internet Malware", Proceedings of the 2012 IEEE Symposium
on Security and Privacy (SP'12), pp. 443-457, 2012.
[5] ƔƵǹƣ, ƿžǹè, ľŮƽ‹, "ÃƇDžŐ@»Ž!ǼǍÄ J
avaScript Q‚cDžŐUW`u-öƻ)lj£", http://www.iwsec.
org/mws/2010/presentation/2A3-1.pdf
[6] ƔƵǹƣ, ƿžǹè, üĀėƩ, ľŮƽ‹, "ĦǑŘķDžŐʼn,
:=†Š+ JavaScript -ųēŰĦ¶Ģũ-ĬŖ", CSS2011
[7] òƶŚĘ, ùžƊĵ, ƴŦŪĽ, ǓŁǗ, "ǝ¥-ǦƘ,ƋƉ
!†Š|\E~Nb-ŗ¶,:=ęĖ Web SEbŗƌUW`
u-ĬŖ", Ěàµźð—ƎƚàÔ, Vol.2011-CSEC-54, No. 3
2, pp. 1-6, 2011.
[8] L.Page, S.Brin, R.Motwani, T. Winograd, "The pagerank citati
on ranking: Bringing order to the web", 1998
[9] ƕÿŭĿ, °ʼn Ţ, ǫż½ƀ, "IJA Web SEb-|\E~
Nb,ß&ęĖ Web SEb-żïňǭŬõ", Ěàµźð—
ƎƚàÔ, Vol. 2014-SPT-8, No.32, pp. 1-6, 2014.
[10] Alexa, "Actionable Analytics for the Web", http://www.alexa.co
m/
[11]ƕÿŭĿ, ƔƵǹƣ, ŏʼnǶô, Ƃž­ċ, "s}FGCúƟ!7-ƎƚŽa‚[Y^bȊMWS Datasets 2014Ȋ", Ěàµ
źð—ƎƚàÔ, Vol. 2014-CSEC-66, No. 19, pp. 1-7, 2014.
― 933 ―

kwara - Inec