| Both sides previous revisionPrevious revision | |
| security [2026/09/25 03:03] – Add ninth child security:domain_abuse to the namespace table; box, heading and methodology paragraph now say nine; design:dns boundary bullet. Authored by Claude. karel.kubicek.claude | security [2026/10/08 12:10] (current) – Add tenth child Security:Malicious web content (row, box, counts nine->ten). Authored by Claude karel.kubicek.claude |
|---|
| ====== Security ====== | ====== Security ====== |
| |
| This namespace is for **measuring web security as it is deployed** — TLS on public sites, the headers a crawl can see, the label sources people use for "malicious", phishing sites in the wild, scam sites and campaigns, abuse of the domain namespace, web vulnerabilities classified in papers that also measured the web. It is not a tutorial on attacks, and it is not the rest of computer security. The [[literature:corpus|publication corpus]] behind these pages is seven broad **security, privacy and measurement** venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, **5,859** extracted papers), so a keyword search for "security" is not a population. Each child page names its own. | This namespace is for **measuring web security as it is deployed** — TLS on public sites, the headers a crawl can see, the label sources people use for "malicious", phishing sites in the wild, scam sites and campaigns, abuse of the domain namespace, malicious content served to visitors, web vulnerabilities classified in papers that also measured the web. It is not a tutorial on attacks, and it is not the rest of computer security. The [[literature:corpus|publication corpus]] behind these pages is seven broad **security, privacy and measurement** venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, **5,859** extracted papers), so a keyword search for "security" is not a population. Each child page names its own. |
| |
| <WRAP important> | <WRAP important> |
| **A namespace page outlines the pages inside it rather than carrying its own content.** (([[contributing]], "Namespace and page structure".)) All **nine** pages in this namespace are listed below and written — this table, not [[start]], is the authority on what is here. Each was proposed from this corpus, and none is a red link: [[Security:Web vulnerabilities]], [[Security:TLS certificates]], [[Security:Phishing]], [[Security:Headers]], [[Security:VirusTotal]], [[Security:Email authentication]], [[Security:Authentication]], [[Security:Online scams]] and [[Security:Domain abuse]]. Three further candidates were assessed and not given a page; Google Safe Browsing was folded into phishing rather than made a page of its own — see [[#Rejected, and why]]. | **A namespace page outlines the pages inside it rather than carrying its own content.** (([[contributing]], "Namespace and page structure".)) All **ten** pages in this namespace are listed below and written — this table, not [[start]], is the authority on what is here. Each was proposed from this corpus, and none is a red link: [[Security:Web vulnerabilities]], [[Security:TLS certificates]], [[Security:Phishing]], [[Security:Headers]], [[Security:VirusTotal]], [[Security:Email authentication]], [[Security:Authentication]], [[Security:Online scams]], [[Security:Domain abuse]] and [[Security:Malicious web content]]. Three further candidates were assessed and not given a page; Google Safe Browsing was folded into phishing rather than made a page of its own — see [[#Rejected, and why]]. |
| </WRAP> | </WRAP> |
| |
| ===== The nine pages ===== | ===== The ten pages ===== |
| |
| ^ Page ^ What a fresh student needs it for ^ What the corpus can carry (2026-08-27) ^ | ^ Page ^ What a fresh student needs it for ^ What the corpus can carry (2026-08-27) ^ |
| | [[Security:Online scams]] | You are about to measure fake shops, tech-support scam pages, or crypto giveaway and investment sites, and need to know where the seed list comes from, how to group sites into operators, and what counts as harm. | **27** papers, hand-verdicted from **183** candidates produced by five full-text and schema probes — 14.8% precision. 26 of the 27 include the web platform and 24 ran a crawl. **1** of the 27 classifies scam sites with an LLM. The line with [[Security:Phishing]] is what the victim hands over: credentials or a signature there, money here. Start with Kotzias et al. {[kotzias2025_ctrl]}, Bitaab et al. {[bitaab2025_scammagnifier]}, Liu et al. {[liu2024_give]} and Szurdi et al. {[szurdi2021_where]}. | | | [[Security:Online scams]] | You are about to measure fake shops, tech-support scam pages, or crypto giveaway and investment sites, and need to know where the seed list comes from, how to group sites into operators, and what counts as harm. | **27** papers, hand-verdicted from **183** candidates produced by five full-text and schema probes — 14.8% precision. 26 of the 27 include the web platform and 24 ran a crawl. **1** of the 27 classifies scam sites with an LLM. The line with [[Security:Phishing]] is what the victim hands over: credentials or a signature there, money here. Start with Kotzias et al. {[kotzias2025_ctrl]}, Bitaab et al. {[bitaab2025_scammagnifier]}, Liu et al. {[liu2024_give]} and Szurdi et al. {[szurdi2021_where]}. | |
| | [[Security:Domain abuse]] | You are about to measure typosquatting, parked or expired domains, or dangling DNS records, and need to know which generator and registration source define your population, what WHOIS still tells you after the GDPR and the move to RDAP, and what registering a name to measure its traffic commits you to. | **48** papers, hand-verdicted from **149** candidates produced by six full-text and schema probes — 32.2% precision; 40 are about the namespace, 8 measure it in one section. 24 of the 48 include the web platform and 18 ran a crawl. **19** registered or took control of names to measure them; **0** classify with an LLM. The line with [[Security:Phishing]] is what the lookalike is used for; resolution itself is [[Design:DNS]]. Start with Kintis et al. {[kintis2017_hiding]}, Adjibi et al. {[adjibi2025_guardians]}, So et al. {[so2022_spots]} and Squarcina et al. {[squarcina2021_subdomain]}. | | | [[Security:Domain abuse]] | You are about to measure typosquatting, parked or expired domains, or dangling DNS records, and need to know which generator and registration source define your population, what WHOIS still tells you after the GDPR and the move to RDAP, and what registering a name to measure its traffic commits you to. | **48** papers, hand-verdicted from **149** candidates produced by six full-text and schema probes — 32.2% precision; 40 are about the namespace, 8 measure it in one section. 24 of the 48 include the web platform and 18 ran a crawl. **19** registered or took control of names to measure them; **0** classify with an LLM. The line with [[Security:Phishing]] is what the lookalike is used for; resolution itself is [[Design:DNS]]. Start with Kintis et al. {[kintis2017_hiding]}, Adjibi et al. {[adjibi2025_guardians]}, So et al. {[so2022_spots]} and Squarcina et al. {[squarcina2021_subdomain]}. | |
| | | [[Security:Malicious web content]] | You are about to measure malicious code that sites, ads or redirect chains serve to visitors — in-browser miners, exploit pages, malicious ads, payment skimmers, a compromised third-party script — and need to know which of those phenomena are still alive, why a blocklist cannot be your label, and why one crawl undercounts. | **39** papers, hand-verdicted from **261** candidates produced by seven probes — 14.9% precision; 36 about it, 3 measuring it in one section. 38 include the web platform and 33 ran a crawl. **None is from 2024–2026**: exploit-kit papers end in 2015, mining papers in 2021, the last paper is from 2023 — the page checks whether that is the field or the corpus funnel, and what industry and government sources report since. **22** of the 39 report how much a blocklist or antivirus engine caught or missed; **0** classify with an LLM. The line with [[Security:Online scams]] is the destination: malware or a forced download here, a payment there. Start with Konoth et al. {[konoth2018_minesweeper]}, Vadrevu and Perdisci {[vadrevu2019_discovering]}, Szurdi et al. {[szurdi2021_where]} and Yang et al. {[yang2023_trident]}. | |
| ===== Where this namespace stops ===== | ===== Where this namespace stops ===== |
| |
| ===== Methodology and limitations of these figures ===== | ===== Methodology and limitations of these figures ===== |
| |
| The **nine** is **both** the number of rows in the table above //and// the number of pages whose id begins ''security:'' in the live wiki index; ''scripts/report_namespace_overviews.mjs'' refuses to pass unless those two are the same **set**, not merely the same size. Re-derived 2026-09-25, when the ninth child was added. The box read "[[Security:VirusTotal]] remains a red link until written" for thirteen days after that page was created on 2026-08-27; it was corrected on 2026-09-09 in the edit that added the sixth child, and the set check above is what would have caught it on the day rather than on the next person to read the box. | The **ten** is **both** the number of rows in the table above //and// the number of pages whose id begins ''security:'' in the live wiki index; ''scripts/report_namespace_overviews.mjs'' refuses to pass unless those two are the same **set**, not merely the same size. Re-derived 2026-10-08, when the tenth child was added. The box read "[[Security:VirusTotal]] remains a red link until written" for thirteen days after that page was created on 2026-08-27; it was corrected on 2026-09-09 in the edit that added the sixth child, and the set check above is what would have caught it on the day rather than on the next person to read the box. |
| |
| Every other number in the table above is a count of **papers**, from the 5,859-paper extraction, with the denominator named in the same cell. Four rows are exceptions in kind rather than in rigour: the email-authentication 31 is a hand-mapped topical slice of a published 354-paper candidate pool, the authentication 45 is a hand audit of 184 probe candidates, the online-scams 27 is a hand verdict over 183 probe candidates, and the domain-abuse 48 is a hand verdict over 149 probe candidates. None is a query result, and all four pages say so. Full-text probes read ''paper.cols.txt'' (4 of 5,859 have none and are counted as negatives). 2025–2026 venue-years are provisional — see [[literature:corpus]]. The queries, the folds, the residue, and the unedited report output are on [[provenance:security]]. | Every other number in the table above is a count of **papers**, from the 5,859-paper extraction, with the denominator named in the same cell. Five rows are exceptions in kind rather than in rigour: the email-authentication 31 is a hand-mapped topical slice of a published 354-paper candidate pool, the authentication 45 is a hand audit of 184 probe candidates, the online-scams 27 is a hand verdict over 183 probe candidates, the domain-abuse 48 is a hand verdict over 149 probe candidates, and the malicious-web-content 39 is a hand verdict over 261 probe candidates. None is a query result, and all five pages say so. Full-text probes read ''paper.cols.txt'' (4 of 5,859 have none and are counted as negatives). 2025–2026 venue-years are provisional — see [[literature:corpus]]. The queries, the folds, the residue, and the unedited report output are on [[provenance:security]]. |
| |
| <bibtex bibliography></bibtex> | <bibtex bibliography></bibtex> |
