DeltaPhish: Detecting Phishing Webpages in Compromised Websites
By Igino Corona, Battista Biggio, M. Contini, Luca Piras, Roberto Corda, Mauro Mereu, Guido Mureddu, Davide Ariu, Fabio Roli. 2017
87 citations recorded by the source corpus.
The large-scale deployment of modern phishing attacks relies on the automatic exploitation of vulnerable websites in the wild, to maximize profit while hindering attack traceability, detection and blacklisting. To the best of our knowledge, this is the first work that specifically leverages this adversarial behavior for detection purposes. We show that phishing webpages can be accurately detected by highlighting HTML code and visual differences with respect to other (legitimate) pages hosted within a compromised website. Our system, named DeltaPhish, can be installed as part of a web application firewall, to detect the presence of anomalous content on a website after compromise, and eventually prevent access to it. DeltaPhish is also robust against adversarial attempts in which the HTML code of the phishing page is carefully manipulated to evade detection. We empirically evaluate it on more than 5,500 webpages collected in the wild from compromised websites, showing that it is capable of detecting more than 99% of phishing webpages, while only misclassifying less than 1% of legitimate pages. We further show that the detection rate remains higher than 70% even under very sophisticated attacks carefully designed to evade our system.
Subfields: Computer Networks and Communications, Information Systems, Privacy & Security, Signal Processing
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Computer Networks and Communications
- Fabio Roli
- Battista Biggio
- Giorgio Fumera
- Giorgio Giacinto
- Davide Maiorca
- Ambra Demontis
- Blaine Nelson
- Shishir Nagaraja
In Information Systems
- Fabio Roli
- Battista Biggio
- Giorgio Fumera
- Giorgio Giacinto
- Blaine Nelson
- Davide Maiorca
- Joseph Gardiner
- Shishir Nagaraja
In Privacy & Security
- Battista Biggio
- Fabio Roli
- Giorgio Fumera
- Davide Maiorca
- Giorgio Giacinto
- Joseph Gardiner
- Shishir Nagaraja
In Signal Processing
- Battista Biggio
- Fabio Roli
- Giorgio Fumera
- Giorgio Giacinto
- Davide Maiorca
- Ambra Demontis
- Nicholas Carlini
- Marco Melis
Citations in the corpus
- Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “A very clear example of this is provided by phishing kits , which automatically compromise legitimate (vulnerable) websites in the wild, and hide phishing webpages within them [52, 53].”