Visual-similarity-based phishing detection

By Eric Medvet, Engin Kirda, Christopher Krügel. 2008

207 citations recorded by the source corpus.

Phishing is a form of online fraud that aims to steal a user's sensitive information, such as online banking passwords or credit card numbers. The victim is tricked into entering such information on a web page that is crafted by the attacker so that it mimics a legitimate page. Recent statistics about the increasing number of phishing attacks suggest that this security problem still deserves significant attention. In this paper, we present a novel technique to visually compare a suspected phishing page with the legitimate one. The goal is to determine whether the two pages are suspiciously similar. We identify and consider three page features that play a key role in making a phishing page look similar to a legitimate one. These features are text pieces and their style, images embedded in the page, and the overall visual appearance of the page as rendered by the browser. To verify the feasibility of our approach, we performed an experimental evaluation using a dataset composed of 41 real-world phishing pages, along with their corresponding legitimate targets. Our experimental results are satisfactory in terms of false positives and false negatives.

Subfields: Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

DeltaPhish: Detecting Phishing Webpages in Compromised Websites (2017, background): “However, mainly due to the higher computational complexity of this kind of analysis, only few approaches have combined HTML and visual features for target-dependent phishing detection [11, 32], and it is not clear to which extent they can be robust against well-crafted adversarial attacks.”
PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, background): “Our study presents accurate measurements of the duration and effectiveness of this popular threat, and discusses many new and interesting aspects we observed by monitoring hundreds of phishing campaigns.”
Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding (2019, methodology): “[22] presented a novel technique to visually compare a suspected phishing page with a legitimate one,”
Phishing Attacks: A Recent Comprehensive Study and a New Anatomy (2021, background): “Although these attacks affect organizations and individuals alike, the loss for the organizations is signi ﬁ cant, which includes the cost for recovery, the loss of reputation, ﬁ nes from information laws/ regulations, and reduced productivity (Medvet et al., 2008).”