When Push comes to Ads: Measuring the Rise of (Malicious) Push Advertising

Abstract

The rapid growth of online advertising has fueled the growth of ad-blocking software, such as new ad-blocking and privacy-oriented browsers or browser extensions. In response, both ad publishers and ad networks are constantly trying to pursue new strategies to keep up their revenues. To this end, ad networks have started to leverage the Web Push technology enabled by modern web browsers. As web push notifications (WPNs) are relatively new, their role in ad delivery has not yet been studied in depth. Furthermore, it is unclear to what extent WPN ads are being abused for malvertising(i.e., to deliver malicious ads). In this paper, we aim to fill this gap. Specifically, we propose a system called PushAdMiner that is dedicated to (1)automatically registering for and collecting a large number of web-based push notifications from publisher web-sites, (2) finding WPN-based ads among these notifications, and (3)discovering malicious WPN-based ad campaigns.