PhishNet: Predictive Blacklisting to Detect Phishing Attacks

By Pawan Prakash, Manish Kumar, Ramana Rao Kompella, Minaxi Gupta. 2010 Proceedings IEEE INFOCOM, 2010

443 citations recorded by the source corpus.

Phishing has been easy and effective way for trickery and deception on the Internet. While solutions such as URL blacklisting have been effective to some degree, their reliance on exact match with the blacklisted entries makes it easy for attackers to evade. We start with the observation that attackers often employ simple modifications (e.g., changing top level domain) to URLs. Our system, PhishNet, exploits this observation using two components. In the first component, we propose five heuristics to enumerate simple combinations of known phishing sites to discover new phishing URLs. The second component consists of an approximate matching algorithm that dissects a URL into multiple components that are matched individually against entries in the blacklist. In our evaluation with real-time blacklist feeds, we discovered around 18,000 new phishing URLs from a set of 6,000 new blacklist entries. We also show that our approximate matching algorithm leads to very few false positives (3%) and negatives (5%).

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/0123919e2a957f55517fedef053ae0ac50da052c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Emerging phishing trends and effectiveness of the anti-phishing landing page (2014, background): “, there is a good chance that phishing URLs share a common directory structure, but with different filename or query string [34].”
Proactive Discovery of Phishing Related Domain Names (2012, unknown): “Another proactive blacklisting approach to detect phishing domains is addressed through Phishnet in [20].”
Phishing Detection: A Literature Survey (2013, background): “PhishNet [28] addresses the exact match limitation found in blacklists.”
Cracking Classifiers for Evasion: A Case Study on the Google's Phishing Pages Filter (2016, methodology): “To minimize the impact of phishing attacks, a variety of methods have been proposed to detect phishing pages, involving machine learning [37][53][58] or other techniques [26][27][29][31][33][46][60][61].”
You're Not Who You Claim to Be: Website Identity Check for Phishing Detection (2010, unknown): “Ours CAN- Hybrid- Beyond Phish(Simple- TINA Phish Blacklist Net Logistic) [21] [19] [9] [13] TPR(%) 98.”