Detection and mitigation of abusive web traffic using convolutional neural networks

Illicit websites depend upon abusive Traffic Distribution Systems (TDSs) to generate user traffic for malicious. Traffic Distribution Systems are the intermediate websites that redirect the HTTP traffic from online advertisements. However, such systems also started to promote abusive activities such as phishing, scams, ad frauds, malicious downloads, and social engineering attacks. In this study, we present Online Abusive Traffic Finder (OATF), an enhanced web security protection system designed to investigate and evaluate abusive TDSs and their associated threats. A total of 10,746 webpages were collected over a one-month period (May 15, 2024-June 14, 2024) from four diverse traffic sources, including advertisement-based URL shortening services, typosquatting websites, unlicensed online pharmacy sites, and the PhishTank dataset. We use these sources due to their diverse nature to redirect users toward abusive and malicious sites. During data collection process, we collect destination web pages screenshots, browser, and content logs. We semi automatically label collected pages and use labeled data to automatically examine page content to understand the threats from these traffic sources. To protect users from abusive TDSs, a Convolutional neural network (CNN) based classifier is integrated as a supporting component for automated detection of abusive webpages using visual features. The CNN model achieved the highest accuracy (91.92%) within the proposed framework. The proposed approach provides deeper insights into the operational behavior of abusive traffic ecosystems and contributes toward improving web security against evolving malicious distribution strategies.