07-02-2015, 11:48 PM
dfd for an online phishing detection system
|
dfd for an online phishing detection system
|
dfd for an online phishing detection system
31-03-2017, 03:53 PM
Phishing is an online theft of confidential information that misleads innocent users into disclosing private information such as usernames, passwords, and credit card numbers. The reported number of phishing attacks is growing daily, therefore, the resulting loss of damages are increasing. As a result, there is an urgent need for anti-phishing solutions emerging from both researchers and the IT industry globally. Although a number of solutions have been proposed to mitigate phishing attacks, they continue to experience high false positive and negative results, as well as questioning the feasibility of their implementation.
Phishing is an online identity theft where attackers use social engineering to appear as a trusted identity for valuable information. Phishing exploits human vulnerabilities rather than software vulnerabilities. It addresses many types of sensitive information, including usernames, passwords, social security numbers, credit card numbers, bank accounts, and other useful personal information. In recent years we have seen an increase in the number of phishing attacks with many variants of techniques aimed at all sectors of society. As reported by the Anti-Phishing Working Group, "Payment Services continued to be the most targeted industrial sector in 2014." Many of the phishing techniques are sophisticated, and it is very difficult for Internet users to defend themselves against them. Damage caused by phishing ranges from minor to substantial financial loss.
According to statistics provided by APWG in its Phishing Activity Trends Report, "Overall phishing activity increased by 20 percent in the third quarter of 2013 from the previous quarter," and Cyveillance 2008's official report reported phishing attacks Against more than 2,000 brands in 30 countries. These organizations range from thousands to millions of dollars per attack. Phishing techniques usually involve supplanting legitimate websites to send personal information directly to the phisher, or using malicious software that sends victim data without their knowledge. In a typical phishing attacks, the victim receives fraudulent email by asking them to visit a website and confirm their information at any given time. The email provides a legitimate looking URL that goes to a fake website where victims are going to enter their information. Several phishing solutions exist as black lists that are databases of known phishing sites, whitelists, community assessments, URLs analysis and web page content (images and text), using machine learning techniques and various heuristics to To detect phishing attacks. This article provides the following contribution: We use URL structure, four lexical features and page rankings to capture phishing attacks that rely on misleading links. Each URL is evaluated corresponding to three heuristics (subdomain, main domain and path) and three lexical features extracted from the URL combined with the page ranking received from the classification services. The proposed method does not require changes to the server and will prevent phishing attacks based on fraudulent URLs. This solution uses resources such as search engine suggestions and third-party services (Alexa and Google Page Rank).
|
« Next Oldest | Next Newest »
|
