PhishLive: A View of Phishing and Malware Attacks from an Edge Router

Cao, Lianjie; Probst, Thibaut; Kompella, Ramana Rao

doi:10.1007/978-3-642-36516-4_24

Cited by 2 publications

(1 citation statement)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unlike detection oriented phishing approaches, PhishLive [43] searches for malicious URL presence and frequency within the traffic of an edge network in order to be able to scale detection tools such as middleboxes. Therefore, the authors particularly focused on timing characteristics and location of malicious URL access.…”

Section: Related Workmentioning

confidence: 99%

PhishStorm: Detecting Phishing With Streaming Analytics

Marchal

Jérôme

State

et al. 2014

IEEE Trans. Netw. Serv. Manage.

169

View full text Add to dashboard Cite

Abstract-Despite the growth of prevention techniques, phishing remains an important threat since the principal countermeasures in use are still based on reactive URL blacklisting. This technique is inefficient due to the short lifetime of phishing Web sites, making recent approaches relying on real-time or proactive phishing URLs detection techniques more appropriate. In this paper we introduce PhishStorm, an automated phishing detection system that can analyse in real-time any URL in order to identify potential phishing sites. PhishStorm can interface with any email server or HTTP proxy. We argue that phishing URLs usually have few relationships between the part of the URL that must be registered (low level domain) and the remaining part of the URL (upper level domain, path, query). We show in this paper that experimental evidence supports this observation and can be used to detect phishing sites. For this purpose, we define the new concept of intra-URL relatedness and evaluate it using features extracted from words that compose a URL based on query data from Google and Yahoo search engines. These features are then used in machine learning based classification to detect phishing URLs from a real dataset. Our technique is assessed on 96,018 phishing and legitimate URLs that results in a correct classification rate of 94.91% with only 1.44% false positives. An extension for a URL phishingness rating system exhibiting high confidence rate (> 99%) is proposed. We discuss in the paper efficient implementation patterns that allow real time analytics using Big Data architectures like STORM and advanced data structures based on Bloom filter.

show abstract

Section: Related Workmentioning

confidence: 99%