Counteracting Phishing Page Polymorphism: An Image Layout Analysis Approach

Abstract

Abstract. Many visual similarity-based phishing page detectors have been developed to detect phishing webpages, however, scammers now create polymorphic phishing pages to breach the defense of those detectors. We call this kind of countermeasure phishing page polymorphism. Polymorphic pages are visually similar to genuine pages they try to mimic, but they use different representation techniques. It increases the level of difficulty to detect phishing pages. In this paper, we propose an effective detection mechanism to detect polymorphic phishing pages. In contrast to existing approaches, we analyze the layout of webpages rather than the HTML codes, colors, or content. Specifically, we compute the similarity degree of a suspect page and an authentic page through image processing techniques. Then, the degrees of similarity are ranked by a classifier trained to detect phishing pages. To verify the efficacy of our phishing detection mechanism, we collected 6, 750 phishing pages and 312 mimicked targets for the performance evaluation. The results show that our method achieves an excellent detection rate of 99.6%.

Intelligent phishing url detection using association rule mining

“…The authors use a trained EMD threshold value to differentiate the legitimate and phishing webpages. Lam et al [17] have proposed an image based approach for detecting phishing webpages. The authentic and the suspected pages are transformed into black and white image.…”

Robust scareware image detection

“…Wang et al applied near duplicate detection to image spam [17]. Mostly, it has been applied in the phishing context though [18,19,20,21]. Medvet et al developed a classifier that identifies phishing pages based on visual text, images contained on the web page as well as a rendering of the web page [20].…”

“…Medvet et al developed a classifier that identifies phishing pages based on visual text, images contained on the web page as well as a rendering of the web page [20]. An alternative approach to identify phishing pages focuses on layout similarity [19].…”

A survey and classification of web phishing detection schemes

“…Comparison is performed when the tab is focused again or the page refreshes itself or redirects to a new URL. Lam et al [84] proposed a scheme based on layout similarity analysis instead of HTML or webpage content analysis. The phishing webpages are divided into blocks and are matched to the original pages by image comparison.…”

“…re-sizing of browser may change the layout drastically, so there will be highfalse positive results; scheme fails if transparent elements are placed on the page that allow user interaction to pass through them. Lam et al [84] Layout similarity technique similar to [82] and [17],but instead of matching CSS layout features, it performs visual matching of the complete webpage .…”