{"id":"https://openalex.org/W2588425636","doi":"https://doi.org/10.3233/jcs-15773","title":"Prometheus: Analyzing WebInject-based information stealers","display_name":"Prometheus: Analyzing WebInject-based information stealers","publication_year":2017,"publication_date":"2017-02-15","ids":{"openalex":"https://openalex.org/W2588425636","doi":"https://doi.org/10.3233/jcs-15773","mag":"2588425636"},"language":"en","primary_location":{"id":"doi:10.3233/jcs-15773","is_oa":true,"landing_page_url":"https://doi.org/10.3233/jcs-15773","pdf_url":"https://content.iospress.com:443/download/journal-of-computer-security/jcs15773?id=journal-of-computer-security%2Fjcs15773","source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://content.iospress.com:443/download/journal-of-computer-security/jcs15773?id=journal-of-computer-security%2Fjcs15773","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5071672404","display_name":"Andrea Continella","orcid":"https://orcid.org/0000-0002-0329-1830"},"institutions":[{"id":"https://openalex.org/I93860229","display_name":"Politecnico di Milano","ror":"https://ror.org/01nffqt88","country_code":"IT","type":"education","lineage":["https://openalex.org/I93860229"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Andrea Continella","raw_affiliation_strings":["Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I93860229"]},{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it","institution_ids":["https://openalex.org/I93860229"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048211949","display_name":"Michele Carminati","orcid":"https://orcid.org/0000-0001-8284-6074"},"institutions":[{"id":"https://openalex.org/I93860229","display_name":"Politecnico di Milano","ror":"https://ror.org/01nffqt88","country_code":"IT","type":"education","lineage":["https://openalex.org/I93860229"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Michele Carminati","raw_affiliation_strings":["Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I93860229"]},{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it","institution_ids":["https://openalex.org/I93860229"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054840981","display_name":"Mario Polino","orcid":"https://orcid.org/0000-0002-0925-2306"},"institutions":[{"id":"https://openalex.org/I93860229","display_name":"Politecnico di Milano","ror":"https://ror.org/01nffqt88","country_code":"IT","type":"education","lineage":["https://openalex.org/I93860229"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Mario Polino","raw_affiliation_strings":["Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I93860229"]},{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it","institution_ids":["https://openalex.org/I93860229"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017862259","display_name":"Andrea Lanzi","orcid":"https://orcid.org/0000-0002-1544-3758"},"institutions":[{"id":"https://openalex.org/I189158943","display_name":"University of Milan","ror":"https://ror.org/00wjc7c48","country_code":"IT","type":"education","lineage":["https://openalex.org/I189158943"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Andrea Lanzi","raw_affiliation_strings":["Universit\u00e0 degli Studi di Milano, Italy. E-mail:\u00a0","Universit\u00e0 degli Studi di Milano, Italy. E-mail:\u00a0andrea.lanzi@unimi.it"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Universit\u00e0 degli Studi di Milano, Italy. E-mail:\u00a0","institution_ids":["https://openalex.org/I189158943"]},{"raw_affiliation_string":"Universit\u00e0 degli Studi di Milano, Italy. E-mail:\u00a0andrea.lanzi@unimi.it","institution_ids":["https://openalex.org/I189158943"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046604572","display_name":"Stefano Zanero","orcid":"https://orcid.org/0000-0003-4710-5283"},"institutions":[{"id":"https://openalex.org/I93860229","display_name":"Politecnico di Milano","ror":"https://ror.org/01nffqt88","country_code":"IT","type":"education","lineage":["https://openalex.org/I93860229"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Stefano Zanero","raw_affiliation_strings":["Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I93860229"]},{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it","institution_ids":["https://openalex.org/I93860229"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5055678575","display_name":"Federico Maggi","orcid":"https://orcid.org/0000-0003-1073-8036"},"institutions":[{"id":"https://openalex.org/I93860229","display_name":"Politecnico di Milano","ror":"https://ror.org/01nffqt88","country_code":"IT","type":"education","lineage":["https://openalex.org/I93860229"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Federico Maggi","raw_affiliation_strings":["Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0,\u00a0,\u00a0,\u00a0,\u00a0","institution_ids":["https://openalex.org/I93860229"]},{"raw_affiliation_string":"Politecnico di Milano, Italy. E-mails:\u00a0andrea.continella@polimi.it,\u00a0michele.carminati@polimi.it,\u00a0mario.polino@polimi.it,\u00a0stefano.zanero@polimi.it,\u00a0federico.maggi@polimi.it","institution_ids":["https://openalex.org/I93860229"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5071672404"],"corresponding_institution_ids":["https://openalex.org/I93860229"],"apc_list":null,"apc_paid":null,"fwci":1.8268,"has_fulltext":true,"cited_by_count":14,"citation_normalized_percentile":{"value":0.86141132,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"25","issue":"2","first_page":"117","last_page":"137"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8267134428024292},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7987910509109497},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7409127950668335},{"id":"https://openalex.org/keywords/personalization","display_name":"Personalization","score":0.6253185868263245},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5819113254547119},{"id":"https://openalex.org/keywords/sophistication","display_name":"Sophistication","score":0.5736700296401978},{"id":"https://openalex.org/keywords/point","display_name":"Point (geometry)","score":0.4491908848285675},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.4304484724998474},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.36258935928344727}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8267134428024292},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7987910509109497},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7409127950668335},{"id":"https://openalex.org/C183003079","wikidata":"https://www.wikidata.org/wiki/Q1000371","display_name":"Personalization","level":2,"score":0.6253185868263245},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5819113254547119},{"id":"https://openalex.org/C168725872","wikidata":"https://www.wikidata.org/wiki/Q991663","display_name":"Sophistication","level":2,"score":0.5736700296401978},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.4491908848285675},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.4304484724998474},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36258935928344727},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3233/jcs-15773","is_oa":true,"landing_page_url":"https://doi.org/10.3233/jcs-15773","pdf_url":"https://content.iospress.com:443/download/journal-of-computer-security/jcs15773?id=journal-of-computer-security%2Fjcs15773","source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"},{"id":"pmh:oai:re.public.polimi.it:11311/1021917","is_oa":true,"landing_page_url":"http://hdl.handle.net/11311/1021917","pdf_url":null,"source":{"id":"https://openalex.org/S4306400312","display_name":"Virtual Community of Pathological Anatomy (University of Castilla La Mancha)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I79189158","host_organization_name":"University of Castilla-La Mancha","host_organization_lineage":["https://openalex.org/I79189158"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.3233/jcs-15773","is_oa":true,"landing_page_url":"https://doi.org/10.3233/jcs-15773","pdf_url":"https://content.iospress.com:443/download/journal-of-computer-security/jcs15773?id=journal-of-computer-security%2Fjcs15773","source":{"id":"https://openalex.org/S106992369","display_name":"Journal of Computer Security","issn_l":"0926-227X","issn":["0926-227X","1875-8924"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310318577","host_organization_name":"IOS Press","host_organization_lineage":["https://openalex.org/P4310318577"],"host_organization_lineage_names":["IOS Press"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Computer Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2588425636.pdf","grobid_xml":"https://content.openalex.org/works/W2588425636.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W186100614","https://openalex.org/W1495745096","https://openalex.org/W1940252083","https://openalex.org/W1977415353","https://openalex.org/W1979562156","https://openalex.org/W2018468546","https://openalex.org/W2052854541","https://openalex.org/W2062147482","https://openalex.org/W2082180526","https://openalex.org/W2125743503","https://openalex.org/W2145688371","https://openalex.org/W2168760272","https://openalex.org/W2170197386","https://openalex.org/W2214740502","https://openalex.org/W3105656675"],"related_works":["https://openalex.org/W4366249425","https://openalex.org/W2900235625","https://openalex.org/W2053293719","https://openalex.org/W3083187169","https://openalex.org/W2594153842","https://openalex.org/W4235738472","https://openalex.org/W2430357810","https://openalex.org/W2076345442","https://openalex.org/W4385934277","https://openalex.org/W3023846186"],"abstract_inverted_index":{"Nowadays":[0],"Information":[1],"stealers":[2],"are":[3,25],"reaching":[4],"high":[5],"levels":[6],"of":[7,11,47,145,148,163],"sophistication.":[8],"The":[9],"number":[10],"families":[12],"and":[13,40,72,113,142,166],"variants":[14,147,162],"observed":[15],"increased":[16],"exponentially":[17],"in":[18,68],"the":[19,107,118,127,169],"last":[20],"years.":[21],"Furthermore,":[22,121],"these":[23],"trojans":[24,93],"sold":[26],"on":[27,76,99,117],"underground":[28],"markets":[29],"along":[30],"with":[31,53],"automatic":[32,86],"frameworks":[33],"that":[34,58,88,94,156],"include":[35],"web-based":[36],"administration":[37],"panels,":[38],"builders":[39],"customization":[41],"procedures.":[42],"From":[43],"a":[44,54,69,143],"technical":[45],"point":[46],"view":[48],"such":[49],"malware":[50,165],"is":[51,89,103,123],"equipped":[52],"functionality,":[55],"called":[56],"WebInject,":[57],"exploits":[59],"API":[60],"hooking":[61],"techniques":[62],"to":[63,91,105,125],"intercept":[64],"all":[65],"sensitive":[66],"data":[67],"browser":[70],"context":[71],"modify":[73],"web":[74],"pages":[75],"infected":[77],"hosts.":[78],"In":[79,151],"this":[80],"paper":[81],"we":[82,154],"propose":[83],"Prometheus,":[84],"an":[85],"system":[87],"able":[90,104,124],"analyze":[92],"base":[95],"their":[96],"attack":[97],"technique":[98],"DOM":[100],"modifications.":[101],"Prometheus":[102,137],"identify":[106],"injection":[108,119],"operations":[109],"performed":[110],"by":[111,130],"malware,":[112],"generate":[114],"signatures":[115],"based":[116],"behavior.":[120],"it":[122],"extract":[126],"WebInject":[128,170],"targets":[129],"using":[131],"memory":[132],"forensic":[133],"techniques.":[134],"We":[135],"evaluated":[136],"against":[138],"real-world,":[139],"online":[140],"websites":[141],"dataset":[144],"distinct":[146],"financial":[149],"trojans.":[150],"our":[152,157],"experiments":[153],"show":[155],"approach":[158],"correctly":[159],"recognizes":[160],"known":[161],"WebInject-based":[164],"successfully":[167],"extracts":[168],"targets.":[171]},"counts_by_year":[{"year":2023,"cited_by_count":3},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}