PhishStorm: Detecting Phishing With Streaming Analytics

Abstract

Abstract-Despite the growth of prevention techniques, phishing remains an important threat since the principal countermeasures in use are still based on reactive URL blacklisting. This technique is inefficient due to the short lifetime of phishing Web sites, making recent approaches relying on real-time or proactive phishing URLs detection techniques more appropriate. In this paper we introduce PhishStorm, an automated phishing detection system that can analyse in real-time any URL in order to identify potential phishing sites. PhishStorm can interface with any email server or HTTP proxy. We argue that phishing URLs usually have few relationships between the part of the URL that must be registered (low level domain) and the remaining part of the URL (upper level domain, path, query). We show in this paper that experimental evidence supports this observation and can be used to detect phishing sites. For this purpose, we define the new concept of intra-URL relatedness and evaluate it using features extracted from words that compose a URL based on query data from Google and Yahoo search engines. These features are then used in machine learning based classification to detect phishing URLs from a real dataset. Our technique is assessed on 96,018 phishing and legitimate URLs that results in a correct classification rate of 94.91% with only 1.44% false positives. An extension for a URL phishingness rating system exhibiting high confidence rate (> 99%) is proposed. We discuss in the paper efficient implementation patterns that allow real time analytics using Big Data architectures like STORM and advanced data structures based on Bloom filter.

Off-the-Hook: An Efficient and Usable Client-Side Phishing Prevention Application

“…[38] of a webpage provides relevant information to identify phishs. Some detection methods rely on URL lexical obfuscation characteristics [12], [33] and webpage hosting related features [30], [39] to decide if a webpage is a phish. The visual similarity of a phish with its target was also exploited to detect phishs [31], [40].…”

“…Other methods focused, as we do, on the study of terms that compose the data sources of a webpage [12], [33] and admit client-side implementation. Cantina [27], [32] was among the first systems to propose a lexical analysis of terms that comprise a webpage.…”

“…An alternative to TF-IDF computation is to use domain name and page title to perform the search query and confirm a webpage as legitimate if its domain name appear in the top-6 results of Google's query [37]. Nevertheless, all these techniques [10], [27], [32], [33], [37] need to perform search queries for each page to analyze which is time and resource consuming. In contrast, Off-the-Hook resorts to search queries in a few occasions when the phishing detector first identifies a webpage as a phish and target identification is thus required.…”

An Investigation towards Paradigm Shift of Cloud Computing Approach and Need of New Security Protocol

“…Although, the work is not related to security technique, but it presents a tightly coupled topology for deployment of BigData, where any security algorithm are easier and involves lesser computational resources. Marchal et al [25] have emphasized their investigations towards securing phishing URLs during analyzing big data [25].…”

“…Figure 7 shows scheme of Marchal et al [25], which performs extraction of embedded links from the email (incoming) over internet. A computation of feature is performed using spidering mechanism and performs forecasting of vulnerability based using machine learning.…”