Visual similarity-based phishing detection without victim site information

Abstract

Phishing attacks, which steal users' account information by fake websites, have become a serious problem on the Internet. There are two major approaches in phishing detection: the blacklist-and the heuristics-based approach. Heuristicsbased approaches employ common characteristics of phishing sites such as distinctive keywords used in web pages or URLs in order to detect new phishing sites that are not yet listed in blacklists. However, these kinds of heuristics can be easily circumvented by phishers once their mechanism is revealed. In order to overcome this weakness, visual similarity-based detection techniques have been proposed. Because phishing sites have to mimic victim sites, visual similarity between phishing sites and their victim sites is supposed to be an inherent and not easily concealable characteristic. However, these techniques require images of real victim sites for detection.In this paper, we propose a phishing detection mechanism based on visual similarity among phishing sites that mimic the same victim site. Surprisingly, just by analyzing visual similarity among web pages without a priori knowledge, our method automatically extracts 224 distinct web page layouts mimicked by 2,262 phishing sites and achieves a detection rate of over 80 % while keeping the false-positive rate to 17.5 %. We also find that the false-positive rate can be reduced.

Eyes of a Human, Eyes of a Program: Leveraging Different Views of the Web for Analysis and Detection

“…Previous solutions involve clustering according to colors, fonts, and layout [27] to identify phishing sites visually similar to trusted sites. Hara et al [15] show that, given a large enough dataset of phishing sites, it is possible to automatically infer the site they are mimicking. These solutions are effective as long as the phishing attack is trying to mimic the aspect of a trusted website, but they do not cover other scam categories, such as fake pharmacies, dubious online retailers, or rogue antiviruses.…”

Experimental Analysis of Browser based Novel Anti-Phishing System Tool at Educational Level

“…To make the fast accessing system, I have defined the study points for the best possible solution. The studied criteria for the phishing have collected from the previous study [26,27,28]. Following are the study points of phishing criteria and the reason for taking these study points are discussed herewith.…”

A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks

“…Using this approach the researchers are able to classify fragments of a file, or embedded files to determine a file type; thus providing a key mitigation mechanism for common file masquerading attacks. Research conducted in [Hara et al 2009] shows how using simple methods to determine integrity, by checking and comparing visual similarity-bsaed phishing can provide accurate and effective results. The researchers demonstrate that by analysing the similarity between visual components in a website, without prior knowledge that it is an attack platform, they are able to automatically determine specific templating of websites that have been spoofed by a large degree of phishes sites.…”