Extension Deltas

Detecting malicious browser extensions through their update deltas, by comparing the JavaScript code additions in each extension version

Project Contents

data:

The data that was used in Stage 1 (ratings & comments anomaly detection) and Stage 2 (API sequence extraction and clustering creation)

results:

The final clusters, including the malicious ones

src:

The code that was used, it is mainly in Python, with the exception of R (comment anomaly detection) and JavaScript (API sequence comparison)

Research Paper

You can read more about the details of our work in the following research paper:

You've Changed: Detecting Malicious Browser Extensions through their Update Deltas PDF
Nikolaos Pantelaios, Nick Nikiforakis, Alexandros Kapravelos
In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2020

@conference{extdeltas-ccs20,
  title = {{You've Changed: Detecting Malicious Browser Extensions through their Update Deltas}},
  author = {Nikolaos Pantelaios, Nick Nikiforakis, Alexandros Kapravelos},
  booktitle = {{In Proceedings of the ACM Conference on Computer and Communications Security (CCS)}},
  year = {2020}
}