Old Wine in A New Bottle: A Homogeneous Fraud Sites Discovery Framework

Internet fraud is a serious threat to the normal order of the Internet, endangering the personal and property safety of its users. Nowadays in China, the most rampant forms of Internet fraud include false winning, false part-time job review, false investment, and phishing websites. Fraud gangs rely on overseas infrastructure and multiple domain names to evade domestic investigation. Meanwhile, they use common open source templates to build such apps or websites to save cost, which enables fast fabrication of apps/websites for various fraud scenarios with limited modifications. In this way, those low cost apps/websites are highly homogeneous in terms of page elements, in other words, "Old Wine in New Bottles". This paper presents a framework that combines both passive and active means for detection of such homogeneous apps/websites from raw Internet traffic. It is a synthesis of rapid detection, convergent verification, and feedback iteration. Having been deployed and verified on an ISP-level backbone in China, the framework is proved to be featured with high detection efficiency, low false-positive rate, and agility of updates.