What does Google rely on to classify the web-page?

[075KG]

Hi~
We can get three kinds of results from sbserver and they are MALWARE-ANY_PLATFORM-URL, UNWANTED_SOFTWARE-ANY_PLATFORM-URL, SOCIAL_ENGINEER-ANY_PLATFORM-URL.
So, how does Google server classify the web-page into these three types?

Thx

[colonelxc]

This has a very high level description of our process: https://www.google.com/transparencyreport/safebrowsing/faq/?hl=en

Here's a link to our policies around these categories: https://safebrowsing.google.com/#policies

[075KG]

Thanks a lot, it helps me so much !!!^.^
But may be it is not so clear to describe how it works. Two examples,
1、How do you determine that a site is unsafe?
For malware sites, we scan sections of our web index to identify potentially compromised websites. Then we test those sites by using a virtual machine to see if the machine gets infected. We use statistical models to identify phishing sites.
So, how does Google identify phishing sites by statistical models?

2、How do you tell the difference between a compromised site and an attack site?
Our scanners can differentiate between the sites that exploit the browser and those that are compromised so that they lead to exploited sites. Sites that exploit the browser are attack sites.
How scanners work to differentiate between the sites that exploit the browser and those that are compromised?

[alexwoz]

Hi @075KG,

We don't provide much detail with regards to our detection infrastructure. However, we have published some papers that you may find interesting:

• Large-Scale Automatic Classification of Phishing Pages: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/35580.pdf
• CAMP: Content-Agnostic Malware Protection: https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/41137.pdf

[075KG]

Thanks a lot~ @alexwoz