{"id":"https://openalex.org/W2114356569","doi":"https://doi.org/10.1145/1963405.1963435","title":"ARROW","display_name":"ARROW","publication_year":2011,"publication_date":"2011-03-28","ids":{"openalex":"https://openalex.org/W2114356569","doi":"https://doi.org/10.1145/1963405.1963435","mag":"2114356569"},"language":"en","primary_location":{"id":"doi:10.1145/1963405.1963435","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1963405.1963435","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 20th international conference on World wide web","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100343045","display_name":"Junjie Zhang","orcid":"https://orcid.org/0000-0002-0855-4118"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Junjie Zhang","raw_affiliation_strings":["Georgia Institute of Technology, Atlanta, GA, USA","Georgia Institute of Technology Atlanta, GA, USA"],"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]},{"raw_affiliation_string":"Georgia Institute of Technology Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060280412","display_name":"Christian Seifert","orcid":"https://orcid.org/0000-0001-9182-8687"},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christian Seifert","raw_affiliation_strings":["Microsoft Bing, Redmond, WA, USA","[Microsoft Bing, Redmond, WA, USA]"],"affiliations":[{"raw_affiliation_string":"Microsoft Bing, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]},{"raw_affiliation_string":"[Microsoft Bing, Redmond, WA, USA]","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059859993","display_name":"Jack W. Stokes","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jack W. Stokes","raw_affiliation_strings":["Microsoft Research, Redmond, WA, USA"],"affiliations":[{"raw_affiliation_string":"Microsoft Research, Redmond, WA, USA","institution_ids":["https://openalex.org/I1290206253"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5047140382","display_name":"Wenke Lee","orcid":"https://orcid.org/0000-0003-2761-1277"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wenke Lee","raw_affiliation_strings":["Georgia Institute of Technology, Atlanta, GA, USA","Georgia Institute of Technology Atlanta, GA, USA"],"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]},{"raw_affiliation_string":"Georgia Institute of Technology Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5100343045"],"corresponding_institution_ids":["https://openalex.org/I130701444"],"apc_list":null,"apc_paid":null,"fwci":29.0259,"has_fulltext":false,"cited_by_count":94,"citation_normalized_percentile":{"value":0.99492316,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"187","last_page":"196"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8101434707641602},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8009452819824219},{"id":"https://openalex.org/keywords/download","display_name":"Download","score":0.7670493721961975},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.5943560600280762},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.44289085268974304},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.44025304913520813},{"id":"https://openalex.org/keywords/web-page","display_name":"Web page","score":0.4305571913719177},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.41149234771728516},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.34380072355270386},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2899233102798462},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.26904213428497314}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8101434707641602},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8009452819824219},{"id":"https://openalex.org/C2780154274","wikidata":"https://www.wikidata.org/wiki/Q7126717","display_name":"Download","level":2,"score":0.7670493721961975},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.5943560600280762},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.44289085268974304},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.44025304913520813},{"id":"https://openalex.org/C21959979","wikidata":"https://www.wikidata.org/wiki/Q36774","display_name":"Web page","level":2,"score":0.4305571913719177},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.41149234771728516},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.34380072355270386},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2899233102798462},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.26904213428497314}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/1963405.1963435","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1963405.1963435","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 20th international conference on World wide web","raw_type":"proceedings-article"},{"id":"pmh:oai:corescholar.libraries.wright.edu:cse-1001","is_oa":false,"landing_page_url":"https://corescholar.libraries.wright.edu/cse/2","pdf_url":null,"source":{"id":"https://openalex.org/S2737205702","display_name":"Journal of Bioresource Management","issn_l":"2309-3854","issn":["2309-3854"],"is_oa":false,"is_in_doaj":true,"is_core":false,"host_organization":"https://openalex.org/P4310316536","host_organization_name":"Bioresource Research Center (BRC), Islamabad","host_organization_lineage":["https://openalex.org/P4310316536"],"host_organization_lineage_names":["Bioresource Research Center (BRC), Islamabad"],"type":"journal"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Computer Science and Engineering Faculty Publications","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W40177048","https://openalex.org/W80155331","https://openalex.org/W162156064","https://openalex.org/W1596634423","https://openalex.org/W1597305440","https://openalex.org/W1827212170","https://openalex.org/W1910686388","https://openalex.org/W1970867218","https://openalex.org/W2051498836","https://openalex.org/W2095610745","https://openalex.org/W2101737524","https://openalex.org/W2111165162","https://openalex.org/W2112063328","https://openalex.org/W2113167642","https://openalex.org/W2126059122","https://openalex.org/W2137786570","https://openalex.org/W2138644293","https://openalex.org/W2157153057","https://openalex.org/W4237690029","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W17155033","https://openalex.org/W3207760230","https://openalex.org/W1496222301","https://openalex.org/W4312814274","https://openalex.org/W1590307681","https://openalex.org/W2536018345","https://openalex.org/W1966145327","https://openalex.org/W1485337887","https://openalex.org/W1995118279","https://openalex.org/W4240624848"],"abstract_inverted_index":{"A":[0,123],"drive-by":[1,72,116,157,162,182],"download":[2,15,73,117,158],"attack":[3],"occurs":[4],"when":[5],"a":[6,9,24,31,46,62,70,102,106,111,155,173,180],"user":[7],"visits":[8],"webpage":[10],"which":[11,149],"attempts":[12],"to":[13,29,49,146,153],"automatically":[14],"malware":[16,25,39],"without":[17],"the":[18,54,80,94,97,115,120,134,177,189,195],"user's":[19],"consent.":[20],"Attackers":[21],"sometimes":[22],"use":[23],"distribution":[26],"network":[27],"(MDN)":[28],"manage":[30],"large":[32,112],"number":[33],"of":[34,77,96,114,125,136,179,191],"malicious":[35,81,144],"webpages,":[36],"exploits,":[37],"and":[38,57,91,170],"executables.":[40],"In":[41,66],"this":[42],"paper,":[43],"we":[44,68,171],"provide":[45,172],"new":[47,161],"method":[48,141],"determine":[50],"these":[51],"MDNs":[52],"from":[53],"secondary":[55],"URLs":[56,95,135],"redirect":[58],"chains":[59],"recorded":[60],"by":[61,84,110,201],"high-interaction":[63],"client":[64],"honeypot.":[65],"addition,":[67],"propose":[69],"novel":[71],"detection":[74,163,183,196],"method.":[75],"Instead":[76],"depending":[78],"on":[79,133,176],"content":[82],"used":[83],"previous":[85],"methods,":[86],"our":[87,192],"algorithm":[88],"first":[89],"identifies":[90],"then":[92,130],"leverages":[93],"MDN's":[98],"central":[99,103,138],"servers,":[100],"where":[101,194],"server":[104,108],"is":[105],"common":[107],"shared":[109],"percentage":[113],"attacks":[118],"in":[119],"same":[121],"MDN.":[122],"set":[124],"regular":[126],"expression-based":[127],"signatures":[128],"are":[129],"generated":[131],"based":[132],"each":[137],"server.":[139],"This":[140],"allows":[142],"additional":[143],"webpages":[145],"be":[147],"identified":[148],"launched":[150],"but":[151],"failed":[152],"execute":[154],"successful":[156],"attack.":[159],"The":[160,185],"system":[164],"named":[165],"ARROW":[166],"has":[167,198],"been":[168,199],"implemented,":[169],"large-scale":[174],"evaluation":[175],"output":[178],"production":[181],"system.":[184],"experimental":[186],"results":[187],"demonstrate":[188],"effectiveness":[190],"method,":[193],"coverage":[197],"boosted":[200],"96%":[202],"with":[203],"an":[204],"extremely":[205],"low":[206],"false":[207],"positive":[208],"rate.":[209]},"counts_by_year":[{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":9},{"year":2019,"cited_by_count":6},{"year":2018,"cited_by_count":9},{"year":2017,"cited_by_count":11},{"year":2016,"cited_by_count":7},{"year":2015,"cited_by_count":10},{"year":2014,"cited_by_count":18},{"year":2013,"cited_by_count":13},{"year":2012,"cited_by_count":5}],"updated_date":"2026-04-04T16:13:02.066488","created_date":"2016-06-24T00:00:00"}