PhishNet: Predictive Blacklisting to Detect Phishing Attacks

Abstract

Abstract-Phishing has been easy and effective way for trickery and deception on the Internet. While solutions such as URL blacklisting have been effective to some degree, their reliance on exact match with the blacklisted entries makes it easy for attackers to evade. We start with the observation that attackers often employ simple modifications (e.g., changing top level domain) to URLs. Our system, PhishNet, exploits this observation using two components. In the first component, we propose five heuristics to enumerate simple combinations of known phishing sites to discover new phishing URLs. The second component consists of an approximate matching algorithm that dissects a URL into multiple components that are matched individually against entries in the blacklist. In our evaluation with real-time blacklist feeds, we discovered around 18,000 new phishing URLs from a set of 6,000 new blacklist entries. We also show that our approximate matching algorithm leads to very few false positives (3%) and negatives (5%).

A Lightweight Anti-Phishing Technique for Mobile Phone

“…For instance, Prakash et al (2010) proposed PhishNet to actively predicted new malicious URL from existing blacklist entries. This was achieved by processing URLs and producing multiple variations of the same URL using IP address equivalence, query string substitution, brand name equivalence, directory structure similarity and top level domain replacement.…”

Experimental Analysis of Browser based Novel Anti-Phishing System Tool at Educational Level

“…[15] have worked on the 27 phishing criteria using the concept of Neural Network. The same criteria have been taken by other researchers to find the solution from phishing attack [16][17][18][19][20]. A survey on the anti-phishing techniques has been done which is helpful in this study [32].…”

Eyes of a Human, Eyes of a Program: Leveraging Different Views of the Web for Analysis and Detection

“…Cybercriminals have also mitigated the efficacy of successful detections by churning through a large set of domains and URLs, with domain flux and URL fluxing [11,26,38,25]. Researchers, in turn, noting that this behavior is generally associated with malicious sites, have used it as a detection feature [20,31]. These fluxing infrastructures are also being detected mining their topology [17], the redirection chains leading to them [24,40,21], and the traffic distributors' system feeding them a stream of users to exploit [22].…”