SEARCHING FOR MALICIOUS HTTP SERVERS BY IDENTIFYING TYPOS IN HTTP RESPONSES

Summary from the TLDR InfoSec newsletter

This post from NCCGroup explains how it utilizes typos in HTTP server responses to develop unique fingerprints to identify malicious servers. NCCGroup’s team sampled 800,000 HTTP responses from Censys scan data and applied a spell-checking model to detect any anomalous activity. The researchers concluded that while typos are useful to group and identify anomalous behavior, they aren’t sufficient alone to detect malicious behavior. Typo-detection should be used as part of a larger framework.