Lexical feature based phishing URL detection using online learning

By Aaron Blum, Brad Wardman, Thamar Solorio, Gary Warner. 2010

231 citations recorded by the source corpus.

Phishing is a form of cybercrime where spammed emails and fraudulent websites entice victims to provide sensitive information to the phishers. The acquired sensitive information is subsequently used to steal identities or gain access to money. This paper explores the possibility of utilizing confidence weighted classification combined with content based phishing URL detection to produce a dynamic and extensible system for detection of present and emerging types of phishing domains. Our system is capable of detecting emerging threats as they appear and subsequently can provide increased protection against zero hour threats unlike traditional blacklisting techniques which function reactively.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

1. Battista Biggio
2. Fabio Roli
3. Igino Corona
4. Davide Ariu
5. Ponnurangam Kumaraguru
6. Srishti Gupta
7. Giorgio Fumera
8. Samuel Marchal

In Information Systems

1. Battista Biggio
2. Fabio Roli
3. Igino Corona
4. Ponnurangam Kumaraguru
5. Srishti Gupta
6. Giorgio Fumera
7. Hung Le
8. Brad Wardman

In Signal Processing

1. Battista Biggio
2. Fabio Roli
3. Igino Corona
4. Giorgio Fumera
5. Giorgio Giacinto
6. Doyen Sahoo
7. Davide Ariu
8. Ponnurangam Kumaraguru

Citations in the corpus

• DeltaPhish: Detecting Phishing Webpages in Compromised Websites (2017, background): “Most of them are based on comparing the candidate phishing webpage against a set of known targets [10, 11], or on extracting some generic features to discriminate between phishing and legitimate webpages [12, 14].”
• Emerging phishing trends and effectiveness of the anti-phishing landing page (2014, methodology): “Blum et al. proposed a method to detect phishing URLs based on SVM [7].”
• Malicious URL Detection using Machine Learning: A Survey (2017, background): “[36] try to enhance the lexical features by considering the usage of bi-gram features, i.”
• Proactive Discovery of Phishing Related Domain Names (2012, methodology): “…on the fly, domains as malicious or benign is widely used, with either batch methods such as SVM, Naive Bayes, Logistic Regression(like in [2–4]), or on-line classifi-cation algorithms such as Confidence Weighted (CW), Adaptive Regularization of Weight (AROW), Passive-Aggressive (PA) (see [5, 9, 15]).”
• High-performance content-based phishing attack detection (2011, methodology): “URL-based detection techniques use features of the URLs themselves to determine whether the link is malicious [9] [10] [11].”
• URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection (2018, methodology): “The SVM was trained on the 5 sets of baseline lexical features described in the previous subsection, according to [2, 25, 27].”