Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

Abstract

Phishing, a continuously growing cyber threat, aims to obtain innocent users' credentials by deceiving them via presenting fake web pages which mimic their legitimate targets. To date, various attempts have been carried out in order to detect phishing pages. In this study, we treat the problem of phishing web page identification as an image classification task and propose a machine learning augmented pure vision based approach which extracts and classifies compact visual features from web page screenshots. For this purpose, we employed several MPEG7 and MPEG7-like compact visual descriptors (SCD, CLD, CEDD, FCTH and JCD) to reveal color and edge based discriminative visual cues. Throughout the feature extraction process we have followed two different schemas working on either whole screenshots in a "holistic" manner or equal sized "patches" constructing a coarse-to-fine "pyramidal" representation. Moreover, for the task of image classification, we have built SVM and Random Forest based machine learning models. In order to assess the performance and generalization capability of the proposed approach, we have collected a mid-sized corpus covering 14 distinct brands and involving 2852 samples. According to the conducted experiments, our approach reaches up to 90.5% F1 score via SCD. As a result, compared to other studies, the suggested approach presents a lightweight schema serving competitive accuracy and superior feature extraction and inferring speed that enables it to be used as a browser plugin.

Local Image Descriptor Based Phishing Web Page Recognition as an Open-Set Problem

“…Apart from HTML content based analysis, they have leveraged descriptors of HOG and Color Context Histograms for revealing color and edge structures belonging to web page snapshots. Similar to Dalgic et al's work [4] they have also applied tile based finer grain analysis in terms of feature representation. Apart from having achieved high classification accuracy their work also exhibits a robust scheme against evasion techniques for phishing instances.…”

“…However, keeping such kind of a huge list is costly and susceptible to "zero-hour" attacks causing vulnerability to undiscovered and non-reported new phishing web pages. As stated in [2,4], heuristics bases approaches employ several features from various source of information such as image, text, URL and DNS records from both legitimate and phishing web sites. Meanwhile, these features are often fed into machine learning methods in order to create effective classifiers for identifying whether a suspicious web page is phishing.…”

“…Apart from one dimensional code, web pages can actually be considered as two dimensional visual stimuli since they are being perceived by users as a graphical entity following to rendering process by browsers [4]. Based on this fact, scammers design and implement phishing web pages being visually similar to their counterparts defined as visual deception [6].…”

“…In this context, we aimed to examine the effect of sampling strategy and rotational variance in problem domain.Furthermore, we have investigated and compared the performance of these two descriptors in the field of phishing web page identification. Moreover, we have trained and tested the suggested scheme on a verified publicly available dataset named as "Phish-Iris" [4]. The dataset subjected to this study involves 1313 training and 1539 testing samples covering 14 different highly phished companies along with a dominant legitimate set.…”

Malicious URL Detection Based on a Parallel Neural Joint Model

“…F.C. Dalgic [11] proposed to utilize SPM to count the features of a website screenshot. Usually, the victims are attacked since they clicked on the URL of the phishing website posted by the attacker.…”