PhishDef: URL names say it all

By Anh Le, Athina Markopoulou, Michalis Faloutsos. 2010

232 citations recorded by the source corpus.

Phishing is an increasingly sophisticated method to steal personal user information using sites that pretend to be legitimate. In this paper, we take the following steps to identify phishing URLs. First, we carefully select lexical features of the URLs that are resistant to obfuscation techniques used by attackers. Second, we evaluate the classification accuracy when using only lexical features, both automatically and hand-selected, vs. when using additional features. We show that lexical features are sufficient for all practical purposes. Third, we thoroughly compare several classification algorithms, and we propose to use an online method (AROW) that is able to overcome noisy training data. Based on the insights gained from our analysis, we propose PhishDef, a phishing detection system that uses only URL names and combines the above three elements. PhishDef is a highly accurate method (when compared to state-of-the-art approaches over real datasets), lightweight (thus appropriate for online and client-side deployment), proactive (based on online classification rather than blacklists), and resilient to training data inaccuracies (thus enabling the use of large noisy training data).

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

1. Xiao Han
2. Nizar Kheir
3. Davide Balzarotti
4. Thomas Engel
5. Radu State
6. Quang Pham
7. Hung Le
8. Samuel Marchal

Citations in the corpus

• DeltaPhish: Detecting Phishing Webpages in Compromised Websites (2017, neutral): “These approaches exploit features computed from the webpage URL and its domain name [16, 14, 17, 18], from its HTML content and structure, and from other sources, including search engines, HTTP cookies, website certifi-cates [19, 20, 10, 21, 22, 23, 24, 25], and even publicly-available blacklisting…”
• PhishEye: Live Monitoring of Sandboxed Phishing Kits (2016, methodology): “Most phishing detection techniques identify phishing pages by building a classifier using different heuristics based on URL features [13, 24] or on the web page content [35, 45, 41].”
• Proactive Discovery of Phishing Related Domain Names (2012, background): “In [13], Le et al. use both batch and on-line classification techniques to show that lexical features extracted from URLs are sufficient to detect phishing domains.”
• URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection (2018, methodology): “There have been other advanced lexical features used, such as Kolmogorv Complexity [32], obfuscation resistant features [22], intra-url relatedness [29], etc.”
• Malicious URL Detection using Machine Learning: A Survey (2017, unknown): “[39] derive new lexical features using heuristics with”