Detection of phishing websites using an efficient feature-based machine learning framework

Rao, Routhu Srinivasa; Pais, Alwyn Roshan

doi:10.1007/s00521-017-3305-0

Cited by 167 publications

(97 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This findings clearly show that, the arms race between anti phishers and scammers is continuing and the techniques of scammers are evolving to evade phishing detection mechanisms. Rao and Pais [3] have grouped these mechanisms into 4 technical categories: (1) list based, (2) heuristics based, (3) visual similarity based and (4) machine learning based methods. Each of these methods have different pros and cons.…”

Section: Introductionmentioning

confidence: 99%

“…According [4], list based attempts rely on gathering phished (black) or clean (white) URLs from various sources to provide a built-in protection mechanism often used in browsers such as Google Safe Browsing API. As [3] states, list based approaches [5] are very sensitive to URL modifications and vulnerable to zero-day phishing attacks. Likewise, Zhang et al [6] addressed the limitations of whitelist based approaches by stating "as the whitelist approach is based on similarity search instead of exact matching, its detection speed is greatly affected by the feature library size and searching strategy".…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

Dalgic

Bozkır

Aydos

2018

2018 2nd International Symposium on Multidisciplinary Studies and Innovative Technologies (ISMSIT)

View full text Add to dashboard Cite

Phishing, a continuously growing cyber threat, aims to obtain innocent users' credentials by deceiving them via presenting fake web pages which mimic their legitimate targets. To date, various attempts have been carried out in order to detect phishing pages. In this study, we treat the problem of phishing web page identification as an image classification task and propose a machine learning augmented pure vision based approach which extracts and classifies compact visual features from web page screenshots. For this purpose, we employed several MPEG7 and MPEG7-like compact visual descriptors (SCD, CLD, CEDD, FCTH and JCD) to reveal color and edge based discriminative visual cues. Throughout the feature extraction process we have followed two different schemas working on either whole screenshots in a "holistic" manner or equal sized "patches" constructing a coarse-to-fine "pyramidal" representation. Moreover, for the task of image classification, we have built SVM and Random Forest based machine learning models. In order to assess the performance and generalization capability of the proposed approach, we have collected a mid-sized corpus covering 14 distinct brands and involving 2852 samples. According to the conducted experiments, our approach reaches up to 90.5% F1 score via SCD. As a result, compared to other studies, the suggested approach presents a lightweight schema serving competitive accuracy and superior feature extraction and inferring speed that enables it to be used as a browser plugin.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

Dalgic

Bozkır

Aydos

2018

2018 2nd International Symposium on Multidisciplinary Studies and Innovative Technologies (ISMSIT)

View full text Add to dashboard Cite

show abstract

“…mentioned in the paper [80] [100], [112]- [114], [120]- [123], [156] [96], [132], [135], [141], [157], [158] [106], [144], [150], [152], [155] Naïve Bayes 12 [93], [101], [112], [141], [154], [156] [106], [118], [136], [148]- [150] Logistic Regression 14 [93], [96], [101], [112], [141], [150], [154]- [156] [106], [118], [120], [127], [129] Random Tree 2 [93], [151] Random Forest 7 [93], [101], [102], [106], [120], [148], [150] Decision Tree 14 [93], [101], [105],…”

Section: ] Precisionmentioning

confidence: 99%

“…Misspelled/Bad domain name 8 U [36], [42], [43], [56], [69], [72], [80], [89] Top Level Domain features 22 U,W,E [36], [38], [43], [46], [65], [69], [70], [78], [85], uW: [105], [107], [110], [113], [138], [139], [152], [154], [157], uE: [163], [170], [182], [194] TTL c value of DNS 9 U,W,E [28], [43], [47], [70], uW: [93], [102], [132], [144], uE: [186] Age of Domain 13 U,W,E [52], uW: [107], [113], [119], [120], [124], [125], [127], [132], [150],…”

Section: Dns Basedmentioning

confidence: 99%

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

Phishing and spear phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and baserate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear phishing and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.

show abstract

“…ML methods [8] are also dependent on the set of features extracted for each web page and further require ground truth phishing and legitimate websites for training. The quality and variety of websites in this training set has a strong effect on the final detection accuracy [9], and it can be expensive to obtain a training set that is suitably sized and diverse.…”

Section: Introductionmentioning

confidence: 99%

Fuzzy Rough Set Feature Selection to Enhance Phishing Attack Detection

Zabihimayvan

Doran

2019

2019 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)

View full text Add to dashboard Cite

Phishing as one of the most well-known cybercrime activities is a deception of online users to steal their personal or confidential information by impersonating a legitimate website. Several machine learning-based strategies have been proposed to detect phishing websites. These techniques are dependent on the features extracted from the website samples. However, few studies have actually considered efficient feature selection for detecting phishing attacks. In this work, we investigate an agreement on the definitive features which should be used in phishing detection. We apply Fuzzy Rough Set (FRS) theory as a tool to select most effective features from three benchmarked data sets. The selected features are fed into three often used classifiers for phishing detection. To evaluate the FRS feature selection in developing a generalizable phishing detection, the classifiers are trained by a separate out-of-sample data set of 14,000 website samples. The maximum F-measure gained by FRS feature selection is 95% using Random Forest classification. Also, there are 9 universal features selected by FRS over all the three data sets. The F-measure value using this universal feature set is approximately 93% which is a comparable result in contrast to the FRS performance. Since the universal feature set contains no features from third-part services, this finding implies that with no inquiry from external sources, we can gain a faster phishing detection which is also robust toward zero-day attacks.

show abstract

Detection of phishing websites using an efficient feature-based machine learning framework

Cited by 167 publications

References 41 publications

Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Fuzzy Rough Set Feature Selection to Enhance Phishing Attack Detection

Contact Info

Product

Resources

About