{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:34:24Z","timestamp":1791459264860,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":46,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,10,30]],"date-time":"2020-10-30T00:00:00Z","timestamp":1604016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100007297","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["N00014-17-1-2541,N00014-20-1-2720"],"award-info":[{"award-number":["N00014-17-1-2541,N00014-20-1-2720"]}],"id":[{"id":"10.13039\/100007297","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Science Foundation","award":["CNS-1703375,CMMI-1842020,CNS-1941617"],"award-info":[{"award-number":["CNS-1703375,CMMI-1842020,CNS-1941617"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,10,30]]},"DOI":"10.1145\/3372297.3423343","type":"proceedings-article","created":{"date-parts":[[2021,3,4]],"date-time":"2021-03-04T16:20:06Z","timestamp":1614874806000},"page":"477-491","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":35,"title":["You've Changed: Detecting Malicious Browser Extensions through their Update Deltas"],"prefix":"10.1145","author":[{"given":"Nikolaos","family":"Pantelaios","sequence":"first","affiliation":[{"name":"North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nick","family":"Nikiforakis","sequence":"additional","affiliation":[{"name":"Stony Brook University, Stony Brook, NY, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alexandros","family":"Kapravelos","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,11,2]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"DBSCAN Algorithm. 2020. https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.cluster.DBSCAN.html. [Online].  DBSCAN Algorithm. 2020. https:\/\/scikit-learn.org\/stable\/modules\/generated\/sklearn.cluster.DBSCAN.html. [Online]."},{"key":"e_1_3_2_2_2_1","unstructured":"Chrome announces no obfuscation anymore on extensions. 2020. https:\/\/blog.chromium.org\/2018\/10\/trustworthy-chrome-extensions-by-default.html.  Chrome announces no obfuscation anymore on extensions. 2020. https:\/\/blog.chromium.org\/2018\/10\/trustworthy-chrome-extensions-by-default.html."},{"key":"e_1_3_2_2_3_1","unstructured":"Extension Apis. 2020 a. https:\/\/cs.chromium.org\/chromium\/src\/chrome\/common\/extensions\/api\/. [Online].  Extension Apis. 2020 a. https:\/\/cs.chromium.org\/chromium\/src\/chrome\/common\/extensions\/api\/. [Online]."},{"key":"e_1_3_2_2_4_1","unstructured":"Native Apis. 2020 b. https:\/\/cs.chromium.org\/chromium\/src\/chrome\/browser\/resources\/. [Online].  Native Apis. 2020 b. https:\/\/cs.chromium.org\/chromium\/src\/chrome\/browser\/resources\/. [Online]."},{"key":"e_1_3_2_2_5_1","volume-title":"Proceedings of the Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb).","author":"B\u00e1n D\u00e9nes","year":"2019"},{"key":"e_1_3_2_2_6_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Bandhakavi Sruthi","year":"2010"},{"key":"e_1_3_2_2_7_1","volume-title":"Proceedings of the Symposium on Network and Distributed System Security (NDSS).","author":"Barth Adam","year":"2010"},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22038-9_1"},{"key":"e_1_3_2_2_9_1","unstructured":"Malware Report by Arstechnica. 2014. UrlNoBreakshttps:\/\/arstechnica.com\/information-technology\/2014\/01\/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates\/.  Malware Report by Arstechnica. 2014. UrlNoBreakshttps:\/\/arstechnica.com\/information-technology\/2014\/01\/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates\/."},{"key":"e_1_3_2_2_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243823"},{"key":"e_1_3_2_2_11_1","unstructured":"Mega NZ Compromised. 2018. UrlNoBreakshttps:\/\/www.zdnet.com\/article\/mega-nz-chrome-extension-caught-stealing-passwords-cryptocurrency-private-keys\/.  Mega NZ Compromised. 2018. UrlNoBreakshttps:\/\/www.zdnet.com\/article\/mega-nz-chrome-extension-caught-stealing-passwords-cryptocurrency-private-keys\/."},{"key":"e_1_3_2_2_12_1","unstructured":"Hoverzoom Extension Malware Controversy. 2013. https:\/\/www.ghacks.net\/2013\/12\/26\/hoverzooms-malware-controversy-imagus-alternative\/.  Hoverzoom Extension Malware Controversy. 2013. https:\/\/www.ghacks.net\/2013\/12\/26\/hoverzooms-malware-controversy-imagus-alternative\/."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243860"},{"key":"e_1_3_2_2_14_1","volume-title":"Proceedings of the USENIX Workshop on Cyber Security Experimentation and Test (CSET).","author":"DeKoven Louis F.","year":"2017"},{"key":"e_1_3_2_2_15_1","unstructured":"Crypto Wallet Extensions. 2020. UrlNoBreakshttps:\/\/news.bitcoin.com\/google-cryptocurrency-wallet-browser. [Online].  Crypto Wallet Extensions. 2020. UrlNoBreakshttps:\/\/news.bitcoin.com\/google-cryptocurrency-wallet-browser. [Online]."},{"key":"e_1_3_2_2_16_1","unstructured":"Freeaddon Fake Extensions. 2017. UrlNoBreakshttp:\/\/freeaddon.com\/warning-adware-virus-distributors-are-making-fake-extensions-based-on-freeaddon-sportifytab\/.  Freeaddon Fake Extensions. 2017. UrlNoBreakshttp:\/\/freeaddon.com\/warning-adware-virus-distributors-are-making-fake-extensions-based-on-freeaddon-sportifytab\/."},{"key":"e_1_3_2_2_17_1","unstructured":"Manifest file. 2020. https:\/\/developer.chrome.com\/extensions\/manifest. [Online].  Manifest file. 2020. https:\/\/developer.chrome.com\/extensions\/manifest. [Online]."},{"key":"e_1_3_2_2_18_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy.","author":"Guha A."},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3267323.3268959"},{"key":"e_1_3_2_2_20_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Jagpal Nav","year":"2015"},{"key":"e_1_3_2_2_21_1","unstructured":"All jQuery Releases. 2020. https:\/\/github.com\/jquery\/jquery\/releases. [Online].  All jQuery Releases. 2020. https:\/\/github.com\/jquery\/jquery\/releases. [Online]."},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"crossref","volume-title":"VisibleV8: In-Browser Monitoring of JavaScript in the Wild","author":"Jueckstock Jordan","DOI":"10.1145\/3355369.3355599"},{"key":"e_1_3_2_2_23_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Kapravelos Alexandros","year":"2014"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24383"},{"key":"e_1_3_2_2_25_1","volume-title":"Breaking Bad: Forecasting Adversarial Android Bad Behavior","author":"Li Shang","year":"2018"},{"key":"e_1_3_2_2_26_1","unstructured":"Google Publisher Tag library. 2020. https:\/\/developers.google.com\/doubleclick-gpt\/reference. [Online].  Google Publisher Tag library. 2020. https:\/\/developers.google.com\/doubleclick-gpt\/reference. [Online]."},{"key":"e_1_3_2_2_27_1","unstructured":"Software Obfuscation. 2020. https:\/\/www.sciencedirect.com\/topics\/computer-science\/obfuscation. [Online].  Software Obfuscation. 2020. https:\/\/www.sciencedirect.com\/topics\/computer-science\/obfuscation. [Online]."},{"key":"e_1_3_2_2_28_1","unstructured":"Obfuscated Extension Online. 2020. https:\/\/chrome.google.com\/webstore\/detail\/linkedin-email-finder-ada\/abpjeombpodcafecdidejijglognakhe. [Online].  Obfuscated Extension Online. 2020. https:\/\/chrome.google.com\/webstore\/detail\/linkedin-email-finder-ada\/abpjeombpodcafecdidejijglognakhe. [Online]."},{"key":"e_1_3_2_2_29_1","unstructured":"Anomalize package in R. 2020. https:\/\/cran.r-project.org\/web\/packages\/anomalize\/index.html. [Online].  Anomalize package in R. 2020. https:\/\/cran.r-project.org\/web\/packages\/anomalize\/index.html. [Online]."},{"key":"e_1_3_2_2_30_1","volume-title":"A generalized extreme studentized residual multiple-outlier-detection procedure in linear regression. Technometrics","author":"Paul Sudhir R","year":"1991"},{"key":"e_1_3_2_2_31_1","author":"Fake Freeaddon","year":"2017","journal-title":"Reviews."},{"key":"e_1_3_2_2_32_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Sanchez-Rola Iskander","year":"2017"},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3029806.3029820"},{"key":"e_1_3_2_2_34_1","unstructured":"Extensions sold and turned into Adware. 2014. https:\/\/www.pcworld.com\/article\/2089580\/spammers-buy-chrome-extensions-and-turn-them-into-adware.html.  Extensions sold and turned into Adware. 2014. https:\/\/www.pcworld.com\/article\/2089580\/spammers-buy-chrome-extensions-and-turn-them-into-adware.html."},{"key":"e_1_3_2_2_35_1","unstructured":"Feedly Extension Takeover (sold). 2014. https:\/\/www.labnol.org\/internet\/sold-chrome-extension\/28377\/.  Feedly Extension Takeover (sold). 2014. https:\/\/www.labnol.org\/internet\/sold-chrome-extension\/28377\/."},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00058"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313458"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052596"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.18"},{"key":"e_1_3_2_2_40_1","unstructured":"Chrome Web Store. 2020. https:\/\/chrome.google.com\/webstore\/category\/extensions. [Online].  Chrome Web Store. 2020. https:\/\/chrome.google.com\/webstore\/category\/extensions. [Online]."},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.17"},{"key":"e_1_3_2_2_42_1","unstructured":"Themes Companies Google Ticket. 2018. https:\/\/groups.google.com\/a\/chromium.org\/forum\/#!topic\/chromium-extensions\/GNHuwqVLhdM.  Themes Companies Google Ticket. 2018. https:\/\/groups.google.com\/a\/chromium.org\/forum\/#!topic\/chromium-extensions\/GNHuwqVLhdM."},{"key":"e_1_3_2_2_43_1","unstructured":"Esprima Tool. 2020. https:\/\/esprima.org\/demo\/parse.html. [Online].  Esprima Tool. 2020. https:\/\/esprima.org\/demo\/parse.html. [Online]."},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134632"},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2736277.2741630"},{"key":"e_1_3_2_2_46_1","unstructured":"Chrome Unobfuscation ZdNet. 2020. https:\/\/www.zdnet.com\/article\/google-to-no-longer-allow-chrome-extensions-that-use-obfuscated-code\/.  Chrome Unobfuscation ZdNet. 2020. https:\/\/www.zdnet.com\/article\/google-to-no-longer-allow-chrome-extensions-that-use-obfuscated-code\/."}],"event":{"name":"CCS '20: 2020 ACM SIGSAC Conference on Computer and Communications Security","location":"Virtual Event USA","acronym":"CCS '20","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3423343","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3423343","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3423343","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:02:20Z","timestamp":1750197740000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3423343"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,30]]},"references-count":46,"alternative-id":["10.1145\/3372297.3423343","10.1145\/3372297"],"URL":"https:\/\/doi.org\/10.1145\/3372297.3423343","relation":{},"subject":[],"published":{"date-parts":[[2020,10,30]]},"assertion":[{"value":"2020-11-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}