An Empirical Analysis of Phishing Blacklists

By Steve Sheng, Brad Wardman, Gary Warner, Lorrie Faith Cranor, Jason I. Hong, Chengshan Zhang. 2009

455 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, background): “The paper found that those blacklists were ineffective as most of them caught less than 20% of phishing pages at hour zero [37].”
A Hierarchical Adaptive Probabilistic Approach for Zero Hour Phish Detection (2010, background): “To underscore this point, Sheng et al [21] evaluated eight popular toolbars including Microsoft Internet Explorer, Firefox, Google Chrome, Norton 360, etc., all of which employ some level of human verification to achieve an extremely low FP in spite of the amount of human labor required, again prima”
Concentrating Correctly on Cybercrime Concentration (2015, background): “looked into how effective toolbars were in detecting that a phishing webpage was being visited [26].”
Large-Scale Automatic Classification of Phishing Pages (2010, methodology): “Despite the noise in the training data, our classifier learns a robust model for identifying phishing pages which correctly classifies more than 90% of phishing pages several weeks after training concludes.”
Malicious URL Detection using Machine Learning: A Survey (2017, background): “We end the survey by discussing the practical issues and open problems in this domain.”
Phishing detection based Associative Classification data mining (2014, background): “Sheng et al. (2009) showed that blacklists are usually updated at different frequencies.”
Phishing Detection: A Literature Survey (2013, background): “This is a significant delay as 63% of phishing campaigns end within the first 2 hours as well [25].”
Learning to Detect Phishing Webpages (2014, background): “…asked to reveal private information such as password, bank account information, credit card number, social security number, etc. Whittaker et al. [42] define a phishing webpage as ”any webpage that, without permission, alleges to act on behalf of a third party with the intention of confusing…”
Social Phishing (2018, methodology): “[18] use 191 fresh phish that are less than 30 minutes old to conduct two tests on eight blacklists based anti-phishing toolbars.”
BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, background): “However, DNS blacklists and phishing blacklists [65], while initially effective have are becoming increasingly ineffective [60] owing to the agility of the attackers.”
A survey of the applications of text mining in financial domain (2016, background): “Sheng et al. (2009) presented a paper on the performance of phishing detection based on blacklist approach.”
Emerging phishing trends and effectiveness of the anti-phishing landing page (2014, background): “Researchers have shown that browser blacklists are not efficient enough to detect the phishing URLs [14] [37].”