Bing Explains More About Malware Detection

[engine]

Webmasters are unhappy that Bing has been unable to advise more about the malware detection and the exploits it has found on a site when marking it unsafe.

There's a new post by Bing about how it goes about detecting and marking sites with malware, and here's Bing's latest.

One challenge the Bing anti-malware team faces is striking the balance between detection completeness and accuracy and one major facet of this challenge is understanding when to “rollup” our malware detection, that is, consider an entire segment of a site or the site itself as malicious. At Bing, the nomenclature we use to describe a collection of URLs at the path, host or domain level is a “container”, and this is the basic unit we use for rollup – essentially if a container is rolled up, then every URL under that container will be considered malware; e.g. a rollup on the host “foo.example.com” will cause every URL on that host to be marked as malicious, whereas a rollup under “example.com/malware” will cause all URLs under the path “/malware” and all its sub-paths to be marked as malicious, but not the homepage or other paths. Extrapolating Malware Detection with Rollup [blogs.bing.com]

Since we made the improvements to our rollup algorithm, we have observed the following changes, which we feel indicate a much higher level of protection for our customers:

Rollup coverage on URLs in the Bing crawled index increased by 2x

60% more high-risk malware URLs flagged with rollup on Bing SERPs

Approximately 0.015% of Bing query traffic affected, that is ~1 in every 7000 queries

Bing advises webmasters to sign up for its tools to get more information about a compromised site.

That's fine, but is it giving out enough data?

Bing overdoing it with Malware detection [webmasterworld.com]

In an earlier post, Bing talked about providing webmasters with more information. Bing Site Safety Information Now More Informative [webmasterworld.com]

Is Bing giving webmasters enough detailed information about the discovery so that webmasters can make changes and resolve the malware issue?

[dstiles]

The problem is: what kind and how much information they give out, bearing in mind they are "helping" the site's owner get out of the detection. If the owner is deliberately publishing the malware then giving away too much information would be saying, "This is how to get around our detection..."