Figures
Interactive versions of the figures from our paper.
Figure 4
Nodes ordered by the fraction of edges they accumulate. The figure shows a high centralization on IP addresses (90% of the edges congregate around only 2% of the addresses). The legend also lists the total number of nodes.
Figure 5
Cumulative number of domains and IP addresses with a threat probability above the depicted value, found via PTP. Categorized into the Virus Total and Google Safe Browsing labels.
Figure 6
Rate of nodes with a score above the depicted threshold that appeared later on the blocklist. Marked are the s e thresholds providing the maximal rate.
Figure 7
Number of nodes identified using an ITEG and the described blocklist as PTP input on each measurement date. Also, showing the percentage of identified nodes that appeared later on the respective blocklist as Appearance Rate.