Sophisticated Phishers Make More Spelling Mistakes: Using URL Similarity against Phishing

Abstract

Abstract. Phishing attacks rise in quantity and quality. With short online lifetimes of those attacks, classical blacklist based approaches are not su cient to protect online users. While attackers manage to achieve high similarity between original and fraudulent websites, this fact can also be used for attack detection. In many cases attackers try to make the Internet address (URL) from a website look similar to the original. In this work, we present a way of using the URL itself for automated detection of phishing websites by extracting and verifying di erent terms of a URL using search engine spelling recommendation. We evaluate our concept against a large test set of 8730 real phishing URLs. In addition, we collected scores for the visual quality of a subset of those attacks to be able to compare the performance of our tests for di erent attack qualities. Results suggest that our heuristics are able to mark 54.3% of the malicious URLs as suspicious. With increasing visual quality of the phishing websites, the number of URL characteristics that allow a detection increases, as well.

What is this URL's Destination? Empirical Evaluation of Users' URL Reading

“…In this section we focus on work which looks at deceiving people with malicious URLs. Numerous studies have shown that people have trouble accurately identifying phishing URLs [14,31,11,15]. Users are generally more likely to draw clues from the page that has been loaded than from the URL or other security indicators [14,4,28,2].…”

Utilisation of website logo for phishing detection

“…The deceptions are simple, yet effective. This has attracted considerably high attention from the anti-phishing researchers to focus on a URL-based approach (Maurer and Höfer, 2012). Nguyen et al (2013) and Verma and Dyer (2015) are among the works that contribute to the URL-based approach.…”

“…Nguyen et al (2013) and Verma and Dyer (2015) are among the works that contribute to the URL-based approach. An interesting one is Maurer and Höfer (2012) which uses spelling recommendations from a search engine and a string similarity algorithm. Since each URL is unique, phishers can only use small spelling mistakes that might go overlooked by unsuspecting users to impersonate a legitimate URL.…”

Hardened Setup of Personalized Security Indicators to Counter Phishing Attacks in Mobile Banking

“…Anti-phishing techniques for the web have been deployed in practice [7,16]. Proposals include automated comparison of website URLs [27], visual comparison of website contents [4,43], use of a separate and trusted authentication device [30], personalized indicators [6,20,33], multi-stage authentication [14], and attention key sequences to trigger security checks on websites [41]. While some of these mechanisms are specific to the web environment, others could be adapted also for mobile application phishing detection.…”