Tuesday, August 25, 2009

Malware Statistics Update

Every now and then people ask us for an update on the malware statistics we published in the All Your iFrames Point To Us blog post. We're glad to share this sort of data because we believe that collaboration and information sharing are crucial in driving anti-malware efforts forward. Here is a small update containing some interesting trends we've observed over the last 12 months.

Number of Entries on the Google Safe Browsing Malware List

As we mentioned in our Top-10 Malware Sites blog post, we have seen a large increase in the number of compromised sites since April. The number of entries on our malware list has more than doubled in one year, and we have seen periods in which 40,000 web sites were compromised per week. However, compared to infections associated with Gumblar and Martuz — two relatively large and well-known pieces of malicious code, many compromised web sites now point to hundreds of different domains. As these malware trends evolve, we're constantly improving our systems to better detect compromised web sites. The increase in compromised sites we observed may have also been influenced by our improved detection capabilities.

Search Results Containing a URL Labeled as Harmful

The above graph shows the percentage of daily queries that contain at least one search result that we labeled as harmful. In January 2008, more than 1.2% of all Google search queries contained at least one such result (you can review a graph of this data in the aforementioned All Your iFrames Point To Us post). Since then, there has been a downward trend to well below 1%. We noticed an increase around May 2009, and that growth may be due to the appearance of a larger number of compromised web sites. That said, it's encouraging that compared to last year, fewer search queries contain results to potentially harmful sites.

Users of Google search, Google Chrome, Mozilla Firefox and Apple Safari receive warnings when visiting sites we identify as potentially harmful. These warnings are produced by our Safe Browsing API, a technology that is freely available for webmasters to implement.

Friday, August 14, 2009

Ask the Google Anti-Malware Team

The Google Anti-Malware engineering team knows you have many questions related to our scanning and flagging of infected sites, some with short and simple answers and some with more complex answers. The short-answer questions are already -- we hope -- adequately handled on the Webmaster Forums; now we want to do a better job at answering the more complex questions.

To this end, we have created a Google Moderator page for you to submit your questions, and to vote on other webmasters' questions. In two weeks (on Friday the 28th of August), we will close the page and select a few of the top-rated questions. Over the course of the next several weeks, we will do our best to answer each of these in a write-up, to be published here and to the Webmaster Malware Forum.

We hope to repeat this exercise (with a fresh Moderator page) in the fall to give you the opportunity to ask more questions.

Thank you, and see you on the Moderator page!