A layout-similarity-based approach for detecting phishing pages

Abstract

Phishing is a current social engineering attack that results in online identity theft. In a phishing attack, the attacker persuades the victim to reveal confidential information by using web site spoofing techniques. Typically, the captured information is then used to make an illegal economic profit by purchasing goods or undertaking online banking transactions. Although simple in nature, because of their effectiveness, phishing attacks still remain a great source of concern for organizations with online customer services.In previous work, we have developed AntiPhish, a phishing protection system that prevents sensitive user information from being entered on phishing sites. The drawback is that this system requires cooperation from the user and occasionally raises false alarms. In this paper, we present an extension of our system (called DOMAntiPhish) that mitigates the shortcomings of our previous system. In particular, our novel approach leverages layout similarity information to distinguish between malicious and benign web pages. This makes it possible to reduce the involvement of the user and significantly reduces the false alarm rate. Our experimental evaluation demonstrates that our solution is feasible in practice.

Security Busters: Web browser security vs. rogue sites

“…A number of approaches has been proposed by the research community to protect users from phishing attacks, which vary from user awareness surveys to experiments of the effectiveness of current security mechanisms and proposals of novel ones. More specifically, the work in Banu et al (2013), Rosiello et al (2007) and Rani and Dubey (2014) focuses on phishing with regards to its properties, characteristics, attack types, and available counter-measures. Authors in Rani and Dubey (2014), Jansson and Von Solms (2013) present a survey on user training methods, as well as their effectiveness against phishing attacks.…”

Eyes of a Human, Eyes of a Program: Leveraging Different Views of the Web for Analysis and Detection

“…AntiPhish [19] tracks sensitive information and informs the user whenever those are given to any untrusted website. DOMAntiPhish [33] alerts the user whenever she visits a phishing site with a layout similar to a trusted website. All these solutions help in preventing that the user is deceived in trusting a site similar to a known site she used in the past, but they do not prevent against other categories of scams, such as fake pharmacies and rogue antiviruses [7,39].…”

The Underground Economy of Fake Antivirus Software

“…Several approaches have been proposed to detect phishing sites such as analyzing page content, layout, and other anomalies [22,26,31]. In addition, studies have analyzed the modus operandi of the criminal operations behind phishing [23], and the effectiveness of phishing defenses [25].…”