GoldPhish: Using Images for Content-Based Phishing Analysis

Abstract

Phishing attacks continue to plague users as attackers develop new ways to fool users into submitting personal information to fraudulent sites. Many schemes claim to protect against phishing sites. Unfortunately, most do not protect against zero-day phishing sites. Those schemes that do allege to provide zero-day protection, often incorrectly label both phishing and legitimate sites. We propose a scheme that protects against zeroday phishing attacks with high accuracy. Our approach captures an image of a page, uses optical character recognition to convert the image to text, then leverages the Google PageRank algorithm to help render a decision on the validity of the site. After testing our tool on 100 legitimate sites and 100 phishing sites, we accurately reported 100% of legitimate sites and 98% of phishing sites.

Detecting Anti Ad-blockers in the Wild

“…One plausible approach is to apply image analysis which is commonly used to detect phishing websites [29,30]. However, in pilot experiments, we found that the visible changes made by anti ad-blockers can be non-intrusive and hard to distinguish from other dynamically generated content.…”

Analisis Ancaman Phishing Dalam Layanan Online Banking

“…Phisher selalu lebih terdepan membuat website palsu yang tidak dapat dideteksi oleh anti-phishing berbasis blacklist/whitelist, GoldPhish menawarkan solusi dengan pendekatan teknik Heuristic dengan menangkap gambar dari halaman website lalu menggunakan optical character recognition untuk mengubah gambar ke teks lalu diintegrasikan dengan algoritma Google Pagerank yang membantu untuk menentukan apakah website tersebut valid atau tidak. GoldPhish diklaim akurat dalam mendeteksi 100% website asli dan 98% mendeteksi website phishing (Dunlop, et al, 2010).…”

A Literature Survey on Anti-Phishing Browser Extensions

“…GoldPhish [8] is a browser extension tool that use content based anti-phishing approached and uses Google as its search engine. This mechanism gives higher ranks to well established web sites.…”