A Human in Every APE: Delineating and Evaluating the Human Analysis Systems of Anti-Phishing Entities

Acharya, Bhupendra; Vadrevu, Phani

doi:10.1007/978-3-031-09484-2_9

Cited by 3 publications

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Such techniques have been improved and nowadays they even involve automatic updates with recent feeds (e.g., PhishTank [6]). However, blocklists are a double-edged sword: on the good side, they are very precise and are hence favored due to the low rate of false alarms; on the bad side, they are only effective against known phishing websites [9]. The latter is a problem: expert attackers are aware of blocklists and hence move their phishing 'hooks' from site to site, bypassing most PWD.…”

Section: Website Outputmentioning

confidence: 99%

See 1 more Smart Citation

SpacePhish: The Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning

Conti

2022

Proceedings of the 38th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Existing literature on adversarial Machine Learning (ML) focuses either on showing attacks that break every ML model, or defenses that withstand most attacks. Unfortunately, little consideration is given to the actual cost of the attack or the defense. Moreover, adversarial samples are often crafted in the "feature-space", making the corresponding evaluations of questionable value. Simply put, the current situation does not allow to estimate the actual threat posed by adversarial attacks, leading to a lack of secure ML systems.We aim to clarify such confusion in this paper. By considering the application of ML for Phishing Website Detection (PWD), we formalize the "evasion-space" in which an adversarial perturbation can be introduced to fool a ML-PWD-demonstrating that even perturbations in the "feature-space" are useful. Then, we propose a realistic threat model describing evasion attacks against ML-PWD that are cheap to stage, and hence intrinsically more attractive for real phishers. Finally, we perform the first statistically validated assessment of state-of-the-art ML-PWD against 12 evasion attacks. Our evaluation shows (i) the true efficacy of evasion attempts that are more likely to occur; and (ii) the impact of perturbations crafted in different evasion-spaces. Our realistic evasion attempts induce a statistically significant degradation (3-10% at 𝑝 <0.05), and their cheap cost makes them a subtle threat. Notably, however, some ML-PWD are immune to our most realistic attacks (𝑝=0.22). Our contribution paves the way for a much needed re-assessment of adversarial attacks against ML systems for cybersecurity.

show abstract

Section: Website Outputmentioning

confidence: 99%

“…Of course, the attacker expects the target ML-PWD to be using 𝐹 𝑐 9. Overall, for our experiments we develop 900 M (given by: 2 source datasets * 50 random draws * 3 𝐹 * 3 A), each assessed against 1200 adversarial examples.…”

mentioning

confidence: 99%

SpacePhish: The Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning

Conti

2022

Proceedings of the 38th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

show abstract

Uncovering the Cloak: A Systematic Review of Techniques Used to Conceal Phishing Websites

Manickam

Laghari

et al. 2023

IEEE Access

View full text Add to dashboard Cite

PhishinWebView: Analysis of Anti-Phishing Entities in Mobile Apps with WebView Targeted Phishing

Choi,

Lee,

Hur

2024

Proceedings of the ACM Web Conference 2024

View full text Add to dashboard Cite

A Human in Every APE: Delineating and Evaluating the Human Analysis Systems of Anti-Phishing Entities

Cited by 3 publications

References 10 publications

SpacePhish: The Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning

SpacePhish: The Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning

Uncovering the Cloak: A Systematic Review of Techniques Used to Conceal Phishing Websites

PhishinWebView: Analysis of Anti-Phishing Entities in Mobile Apps with WebView Targeted Phishing

Contact Info

Product

Resources

About