A Hierarchical Adaptive Probabilistic Approach for Zero Hour Phish Detection

By Guang Xiang, Bryan A. Pendleton, Jason I. Hong, Carolyn Penstein Rosé. 2010

32 citations recorded by the source corpus.

Phishing attacks are a significant threat to users of the Internet, causing tremendous economic loss every year. In combating phish, industry relies heavily on manual verification to achieve a low false positive rate, which, however, tends to be slow in responding to the huge volume of unique phishing URLs created by toolkits. Our goal here is to combine the best aspects of human verified blacklists and heuristic-based methods, i.e., the low false positive rate of the former and the broad and fast coverage of the latter. To this end, we present the design and evaluation of a hierarchical blacklist-enhanced phish detection framework. The key insight behind our detection algorithm is to leverage existing human-verified blacklists and apply the shingling technique, a popular near-duplicate detection algorithm used by search engines, to detect phish in a probabilistic fashion with very high accuracy. To achieve an extremely low false positive rate, we use a filtering module in our layered system, harnessing the power of search engines via information retrieval techniques to correct false positives. Comprehensive experiments over a diverse spectrum of data sources show that our method achieves 0% false positive rate (FP) with a true positive rate (TP) of 67.15% using search-oriented filtering, and 0.03% FP and 73.53% TP without the filtering module. With incremental model building capability via a sliding window mechanism, our approach is able to adapt quickly to new phishing variants, and is thus more responsive to the evolving attacks.

Subfields: Artificial Intelligence, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

DeltaPhish: Detecting Phishing Webpages in Compromised Websites (2017, background): “…URL and its domain name [16, 14, 17, 18], from its HTML content and structure, and from other sources, including search engines, HTTP cookies, website certiﬁ-cates [19, 20, 10, 21, 22, 23, 24, 25], and even publicly-available blacklisting services like Google Safe Browsing and PhishTank [26].”