A method for the automated detection phishing websites through both site characteristics and image analysis

Joshua S. White; Jeanna N. Matthews; John L. Stacy

doi:10.1117/12.918956

7 May 2012 A method for the automated detection phishing websites through both site characteristics and image analysis

Joshua S. White, Jeanna N. Matthews, John L. Stacy

Proceedings Volume 8408, Cyber Sensing 2012; 84080B (2012) https://doi.org/10.1117/12.918956
Event: SPIE Defense, Security, and Sensing, 2012, Baltimore, Maryland, United States

Abstract

Phishing website analysis is largely still a time-consuming manual process of discovering potential phishing sites, verifying if suspicious sites truly are malicious spoofs and if so, distributing their URLs to the appropriate blacklisting services. Attackers increasingly use sophisticated systems for bringing phishing sites up and down rapidly at new locations, making automated response essential. In this paper, we present a method for rapid, automated detection and analysis of phishing websites. Our method relies on near real-time gathering and analysis of URLs posted on social media sites. We fetch the pages pointed to by each URL and characterize each page with a set of easily computed values such as number of images and links. We also capture a screen-shot of the rendered page image, compute a hash of the image and use the Hamming distance between these image hashes as a form of visual comparison. We provide initial results demonstrate the feasibility of our techniques by comparing legitimate sites to known fraudulent versions from Phishtank.com, by actively introducing a series of minor changes to a phishing toolkit captured in a local honeypot and by performing some initial analysis on a set of over 2.8 million URLs posted to Twitter over a 4 days in August 2011. We discuss the issues encountered during our testing such as resolvability and legitimacy of URL's posted on Twitter, the data sets used, the characteristics of the phishing sites we discovered, and our plans for future work.

Citation Download Citation

Joshua S. White, Jeanna N. Matthews, and John L. Stacy "A method for the automated detection phishing websites through both site characteristics and image analysis", Proc. SPIE 8408, Cyber Sensing 2012, 84080B (7 May 2012); https://doi.org/10.1117/12.918956

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available