Collected research

The Ghost in the Browser: Analysis of Web-based Malware

Niels Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang and Nagendra Modadugu · usenix.org

Google's HotBots '07 measurement of drive-by downloads across billions of crawled pages, with instrumented browsers in VMs confirming exploitation. It names four injection routes onto reputable sites: web server compromise, user-contributed content, advertising redirection chains and third-party widgets, each with real obfuscated-JavaScript and iframe examples, plus malware binary churn data.

Record

Researcher

Niels Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang and Nagendra Modadugu

Published by

usenix.org

Topic

Browser

In the archive

• Collected in the 2007 research round

Related sources

• provos Whitepaper

Tags

• measurement-study
• large-scale-scan
• javascript
• iframe
• dynamic-analysis
• detection
• supply-chain
• case-study
• owasp-a06-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Niels Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang and Nagendra Modadugu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.