Collecting and Filtering Out Phishing Suspicious URLs Using SpamTrap System

Abstract

Abstract.Recently, Phishing is a significant security threat to users and has been easy and effective way for trickery and deception on the internet. Phishing is an attempt to acquire our information as well as financial information without user's knowledge by making similar kind of website or sending e-mails to users. Some of the widely available and used phishing detection techniques include whitelisting, blacklisting, and heuristics. But, absolute and perfect antiphishing solutions and techniques are hard to fine due to a variability of phishing site domain. This paper aims to collect and filter out phishing suspicious URLs before determine phishing sites using Spamtrap system which is a honeypot used to collect spam e-mail. Spam e-mail usually contain phishing site URLs, so we can collect phishing site URLs from spam e-mail of spamtrap system. After collect URLs that can be phishing sites, many kind of phishing site detection algorithm can be used in our paper.

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

“…c (pvt.) [21] [38], [72] [22], [41] [38], [41] [72], [77] a Gmail directory [34] b Spam URLs from UAB Spam DataMine email messages [38] c Private SpamTrap system [72], collected using blacklists and crowd-sourcing [41], [77] [78] a MalwareDomainslist [35] and malwareurl [48] b Malware private sources [78] unbalanced, or almost balanced, 9 data. Systems in [43], [59], [73] used more malicious URLs than legitimate ones.…”

“…55%) of the papers surveyed does not report the collection time of datasets. Recency in year(s) N Literature Real-time 5 [62], [29], [68], [72], [77], [86] 1 17…”

“…Misspelled/Bad domain name 8 U [36], [42], [43], [56], [69], [72], [80], [89] Top Level Domain features 22 U,W,E [36], [38], [43], [46], [65], [69], [70], [78], [85], uW: [105], [107], [110], [113], [138], [139], [152], [154], [157], uE: [163], [170], [182], [194] TTL c value of DNS 9 U,W,E [28], [43], [47], [70], uW: [93], [102], [132], [144], uE: [186] Age of Domain 13 U,W,E [52], uW: [107], [113], [119], [120], [124], [125], [127], [132], [150],…”

“…c (pvt.) [21] [38], [72] [22], [41] [38], [41] [72], [77] a Gmail directory [34] b Spam URLs from UAB Spam DataMine email messages [38] c Private SpamTrap system [72], collected using blacklists and crowd-sourcing [41], [77] MalwarePatrol (pub.) [39], [40] [36] DNS-BlackHole (pub.)…”

“…But these are usually static datasets, i.e., data collected over time and stored for usage. Some researchers go a step further -they deployed and tested their classifiers in a real-time environment [72], [77], [86]. Moreover, malicious links can be shared via chat sessions and Twitter feeds -therefore, including the papers that test such sources (under category Feed) is essential.…”