Archived Blog

In Bad Company

04.02.2009 - 5:00 PM

You've heard the saying that a person is judged by the company he keeps. Well, the same can be said of a Web site. When you look at the links between Web pages as a reflection of the connections between topics, then analyzing a site's link neighborhood can be very telling. At Websense, our analysis leads to one clear conclusion: bad leads to bad.

When we analyze the links to and from sites associated with topics that our customers most often prefer to block, we find a rich ecosystem of bad topics linking to other bad topics. For example, take a look at the topics that tend to link to Spyware sites:


Fig 1 – Links to Spyware

We often advise customers that blocking access to sites in the Sex and Gambling categories will cut their risk of encountering Spyware almost in half. In fact, Sex is the number one category that leads to sites that present a security risk (Malicious, Phishing, Spyware, Keyloggers, etc.). If you are surfing Web sites in the Adult categories, you will eventually land on something pretty mean.

You've probably heard that freeware is risky. Our link analysis overwhelmingly supports this. It's a death trap for machines and networks. If you are in the habit of downloading freeware, you will, without a doubt, eventually find something malicious or illegal. The bad links on the Web are so incestuous that if you're surfing adult or gambling sites, or if you live on the edge, visiting anonymous proxy servers or hacking sites, you will eventually reach a malicious or illegal site, possible by means of a freeware site. Once you're in the web of badness, you're stuck.

 
Fig 2 – Links to Freeware

The link connections between topics can be both enlightening and amusing. Who are the people with keen interests in sites in the Abused Drugs category? As you see below, they are also into Alcohol and Tobacco, as well as Violence. They have interest in Weapons, and understandably like to surf the Web anonymously. And if you surf for Adult Content or Sex sites, you are one link away from being sucked into their world.


Fig 3 – Links to Abused Drugs

Who are the people with interest in Militancy and Extremist sites? They have an overwhelming need to surf anonymously, are filled with Racism and Hate, long for Weapons, and are unquestionably into something Illegal or Questionable.


Fig 4 – Links to Militancy and Extremist

While link analysis can be topically enlightening (as well as amusing), here at Websense, Inc., it is used in a wide range of mission critical objectives. Our goal is to classify the Web and protect our customers. A site's link neighborhood is one of many signals that our machine learning classifiers use. Some of these systems attempt to directly classify a site, while others help us prioritize the work of our analysts. We study link neighborhoods to find entry points into badness (Adult, Freeware, and so on). This then enables us to extend our coverage of known bad sites, as well as advise our customers which types of sites are best to block.

In summary, bad links to bad, which links to bad, which links to bad. As the song goes, "Bad Company, I can’t deny / Bad Company, 'til the day I die."

Principal Technology Researcher: Amy Steier
Bookmark This Post: