Kernel k-Means Clustering for Phishing Website and Malware Categorization

Abstract

In these days there are two famous internet attacks these are malware and phishing. Malware stands for malicious software. It is designed to damage computer system without knowledge of the user. Phishing website is comparatively new internet crime to malware attack. Phishing is a form of online fraud such as social engineering schemes by sending e-mails, sudden message or online advertising attract users to phishing website that pretend to be trustworthy website in order to trick individuals sensitive information for illustration-financial accounts, password and personal identification numbers, which is used for profit. Malware and Phishing website is share same properties, firstly increasing at a rate of thousands per day and secondly phishing webpage represented by the term frequencies of the website content share comparable characteristic of malware samples represented through instruction frequencies of the program executable code. Past few years many techniques have been develop to detect malware and phishing website. In these techniques firstly extract feature from phishing website or malware and then categorize them into group. In this paper, we proposed Kernel k-means clustering to categorize malware and phishing website. Kernel k-means is advance version of the k-means algorithm. In which vectors are mapped from vector space to a higher dimensional feature space through kernel function and then k-means is applied in feature space. Thus kernel kmeans avoids the separable clusters in vector space and improves the accuracy of phishing website and malware categorization. General TermsClustering, Internet attack.

Web2Vec: Phishing Webpage Detection Method Based on Multidimensional Features Driven by Deep Learning

“…They treat phishing webpage detection as a classification or clustering problem, and use the corresponding machine learning algorithms to build detection models [8]. Among them, the clustering methods first divide the webpages into several clusters, and then distinguish the phishing webpages from the benign webpages by marking the clusters [9]. On the other hand, the classification methods construct classifiers according to the characteristics of the labeled samples, and then map the unlabeled samples to phishing or benign [10,11].…”

“…In order to resist evasion attacks from attackers, the number of extracted features is increasing. For example, Google Chrome has extracted 2130-dimensional features for phishing detection [9], which greatly increases the complexity of modeling, but leaves the detection efficiency to be improved. At the same time, these techniques are bypassed by the attackers once the algorithms or features are known to the phisher.…”

“…In the offensive and defensive game with phishing, phishing webpage analysis and detection technology have been continuously developed, and the traditional phishing webpage detection methods such as blacklist-based [2], heuristic-based [3,4], visual similarity-based [5,6], and machine learning-based [7][8][9][10][11] methods are proposed, and emerging detection methods based on deep learning [13][14][15][16][17][18][19][20][21] are also proposed in recent years. Traditional phishing webpage detection methods are mainly based on the analysis and modeling of manually extracted multi-source features such as URL features, page content features, and webpage structural features, which once showed strong resistance to phishing attacks.…”