论文标题
网络上第三方资源加载的研究
A Study of Third-party Resources Loading on Web
论文作者
论文摘要
本文对网络中的依赖链进行了大规模的研究，以发现大约50％的第一方网站呈现他们没有直接加载的内容。尽管大多数网站（84.91％）的依赖性链（低于3级），但我们发现依赖链超过30的网站。使用Virustotal，我们表明，这些第三方中的1.2％被归类为可疑的 - 尽管看似很小，但这种有限的可疑第三方设置为广阔的生态系统具有出色的范围。我们发现，有73％的网站来自可疑的第三方的未成年负载资源，而第一方网页中有24.8％至少包含三方在其依赖链中被归类为可疑的第三方。通过运行沙盒实验，我们观察到一系列活动，其中大多数可疑的JavaScript代码下载恶意软件。
This paper performs a large-scale study of dependency chains in the web, to find that around 50% of first-party websites render content that they did not directly load. Although the majority (84.91%) of websites have short dependency chains (below 3 levels), we find websites with dependency chains exceeding 30. Using VirusTotal, we show that 1.2% of these third-parties are classified as suspicious -- although seemingly small, this limited set of suspicious third-parties have remarkable reach into the wider ecosystem. We find that 73% of websites under-study load resources from suspicious third-parties, and 24.8% of first-party webpages contain at least three third-parties classified as suspicious in their dependency chain. By running sandboxed experiments, we observe a range of activities with the majority of suspicious JavaScript codes downloading malware.
