title: Method for detecting core malware sites related to biomedical information systems.
abstract: Most advanced persistent threat attacks target web users through malicious code within landing (exploit) or distribution sites. There is an urgent need to block the affected websites. Attacks on biomedical information systems are no exception to this issue. In this paper, we present a method for locating malicious websites that attempt to attack biomedical information systems. Our approach uses malicious code crawling to rearrange websites in the order of their risk index by analyzing the centrality between malware sites and proactively eliminates the root of these sites by finding the core-hub node, thereby reducing unnecessary security policies. In particular, we dynamically estimate the risk index of the affected websites by analyzing various centrality measures and converting them into a single quantified vector. On average, the proactive elimination of core malicious websites results in an average improvement in zero-day attack detection of more than 20%.
authors.affiliation: Agency for Defense Development, Daejeon 305-600, Republic of Korea.
authors.forename: Dohoon
authors.initials: D
authors.lastname: Kim
authors.affiliation: Agency for Defense Development, Daejeon 305-600, Republic of Korea.
authors.forename: Donghee
authors.initials: D
authors.lastname: Choi
authors.affiliation: Agency for Defense Development, Daejeon 305-600, Republic of Korea.
authors.forename: Jonghyun
authors.initials: J
authors.lastname: Jin
mesh_terms: D000465:Algorithms; D016494:Computer Security; D020407:Internet; D008490:Medical Informatics / Q000379:methods*; D008499:Medical Records; D015233:Models, Statistical; D011381:Programming Languages; D015203:Reproducibility of Results; D012306:Risk; D012984:Software
references.citation: Biomed Res Int. 2014;2014:543051
references.pmid: 25276797
references.citation: ScientificWorldJournal. 2013;2013:704865
references.pmid: 24453892