Research of phishing detection technology

Xi ZHANG; Zhi-wei YAN; Hong-tao LI; Guang-gang GENG

doi:10.11959/j.issn.2096-109x.2017.00180

您当前的位置：

首页 >

文章列表页 >

Research of phishing detection technology

Comprehensive Review | 更新时间：2024-06-03

- Research of phishing detection technology
- Chinese Journal of Network and Information Security Vol. 3, Issue 7, Pages: 7-24(2017)
- 作者机构：
  
  1. 中国科学院计算机网络信息中心，北京 100190
  2. 中国科学院大学，北京 100049
  3. 中国互联网络信息中心互联网域名管理技术国家工程实验室，北京 100190
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00180
  CLC： TP393
- Online First：2017-07，
  
  Published：15 July 2017
- 稿件说明：
移动端阅览
Xi ZHANG, Zhi-wei YAN, Hong-tao LI, et al. Research of phishing detection technology[J]. Chinese Journal of Network and Information Security, 2017, 3(7): 7-24.
DOI：

Xi ZHANG, Zhi-wei YAN, Hong-tao LI, et al. Research of phishing detection technology[J]. Chinese Journal of Network and Information Security, 2017, 3(7): 7-24. DOI： 10.11959/j.issn.2096-109x.2017.00180.

摘要

分析了网络钓鱼欺诈的现状，并对钓鱼检测常用的数据集和评估指标进行了总结。在此基础上，综述了网络钓鱼检测方法，包括黑名单策略、启发式方法、视觉匹配方法、基于机器学习的方法和基于自然语言理解的方法等，对比分析了各类方法的优缺点，进一步指出了钓鱼检测面临的挑战，并展望了钓鱼检测未来的研究趋势。

Abstract

The current status of phishing scams were analyzed and the data sets and evaluation indicators commonly used in phishing detection were summaried.On this basis

a detailed overview of the typical methods of phishing detection was given

which included blacklist strategies

heuristic methods

visual matching methods

and methods based on machine learning and natural language processing.The comparison and analysis of those methods were given

and furtherly

the challenges and future trends of phishing detection were discussed.

关键词

Keywords

references

国家网络空间安全战略 [EB/OL ] . http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm .

National cybersecurity strategy [EB/OL ] . http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm .

Anti-Phishing Working Group(APWG) . Phishing activity trends report-second quarter 2016 [EB/OL ] . https://docs.apwg.org/reports/apwgtrendsreportq22016.pdf https://docs.apwg.org/reports/apwgtrendsreportq22016.pdf .

WEIDER D Y , NARGUNDKAR S , TIRUTHANI N . A phishing vulnerability analysis of web based systems [C ] // Computers and Communications . 2008 : 326 - 331 .

E.M.C.Corporation . RSA monthly fraud report [EB/OL ] . http://australia.emc.com/collateral/fraud-report/h13929-rsa-fraud-report-jan-2015.pdf http://australia.emc.com/collateral/fraud-report/h13929-rsa-fraud-report-jan-2015.pdf .

中国反钓鱼网站联盟 . 2012年中国反钓鱼网站联盟年报 [EB/OL ] . http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf .

APAC . Coalition against phishing site report of China in 2012 [EB/OL ] . http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf .

中国反钓鱼网站联盟 . 2016年9月钓鱼网站处理简报 [EB/OL ] . http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf .

APAC . Phishing site processing presentation in september 2016 [EB/OL ] . http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf .

中国反钓鱼网站联盟 . 中国反钓鱼网站联盟.2015年12月钓鱼网站处理简报 [EB/OL ] . http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf .

APAC . Phishing site processing presentation in september 2015 [EB/OL ] . http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf .

HAN Y F , SHEN Y . Accurate spear phishing campaign attribution and early detection [C ] // The 31st Annual ACM Symposium on Applied Computing . 2016 : 2079 - 2086 .

ALARM S , EL-KHATIB K , . Phishing susceptibility detection through social media analytics [C ] // The 9th International Conference on Security of Information and Networks . 2016 : 61 - 64 .

Krebs on security [EB/OL ] . https://krebsonsecurity.com/2016/04/fbi-2-3-billion-lost-to-ceo-email-scams/ https://krebsonsecurity.com/2016/04/fbi-2-3-billion-lost-to-ceo-email-scams/ .

Anti-Phishing Working Group(APWG) . Global phishing survey:trends and domainname use in 2H2014 [EB/OL ] . http://docs.apwg.org/reports/APWGGlobalPhishingReport2H2014.pdf http://docs.apwg.org/reports/APWGGlobalPhishingReport2H2014.pdf .

YAN G , EIDENBENZ S , GALLI E . Sms-watchdog:profiling social behaviors of SMS users for anomaly detection [C ] // The International Workshop on Recent Advances in Intrusion Detection . 2009 : 202 - 223 .

NASSAR M , NICCOLINI S , EWALD T . Holistic VoIP intrusion detection and prevention system [C ] // The 1st International Conference on Principles,Systems and Applications of IP Telecommunications . 2007 : 1 - 9 .

SONG J , KIM H , GKELIAS A . iVisher:real-time detection of caller ID spoofing [J ] . ETRI Journal , 2014 , 36 ( 5 ): 865 - 875 .

彭富明 , 张卫丰 , 彭寅 . 基于文本特征分析的钓鱼邮件检测 [J ] . 南京邮电大学学报(自然科学版) , 2012 ( 5 ): 140 - 145 .

PENG F M , ZHANG W F , PENG Y . Detection of phishing emails based on text characteristic analysis [J ] . Journal of Nanjing University of Posts and Telecommunication , 2012 ( 5 ): 140 - 145 .

HUSÁK M , CEGAN J . PhiGARo:automatic phishing detection and incident response framework [C ] // Availability,Reliability and Security (ARES) . 2014 : 295 - 302 .

AGGARWAL S , KUMAR V , SUDARSAN S D . Identification and detection of phishing emails using natural language processing techniques [C ] // The 7th International Conference on Security of Information and Networks . 2014 :217.

AKINYELU A A , ADEWUMI A O . Classification of phishing email using random forest machine learning technique [J ] . Journal of Applied Mathematics , 2014 .

YASIN A , ABUHASAN A . An intelligent classification model for phishing email detection [J ] . 2016 , 8 ( 4 ): 55 - 72

VERMA R , RAI N . Phish-IDetector:Message-ID based automatic phishing detection [C ] // e-Business and Telecommunications (ICETE) . 2015 ( 4 ): 427 - 434

黄华军 , 钱亮 , 王耀钧 . 基于异常特征的钓鱼网站URL检测技术 [J ] . 信息网络安全 , 2012 ,( 01 ): 23 - 25 ,67.

HUANG H J , QIAN L , WANG Y J . URL Detecting technology of phshing site based on anomalous characte [J ] . Netinfo Security , 2012 ,( 1 ): 23 - 25 .

BLUM A , WARDMAN B , SOLORIO T , et al . Lexical feature based phishing URL detection using online learning [C ] // The 3rd ACM Workshop on Artificial Intelligence and Security . 2010 : 54 - 60 .

MA J , SAUL L K , SAVAGE S , et al . Identifying suspicious URLs:an application of large-scale online learning [C ] // The 26th Annual International Conference on Machine Learning . 2009 : 681 - 688 .

MA J , SAUL L K , SAVAGE S , et al . Beyond blacklists:learning to detect malicious Web sites from suspicious URLs [C ] // The 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2009 : 1245 - 1254 .

FEROZ M N , MENGEL S . Examination of data,rule generation and detection of phishing URLs using online logistic regression [C ] // 2014 IEEE International Conference on Big Data . 2014 : 241 - 250 .

FEROZ M N , MENGEL S . Phishing URL detection using URL ranking [C ] // The IEEE International Congress on Big Data . 2015 : 635 - 638 .

MARCHAL S , SAARI K , SINGH N , et al . Know your phish:Novel techniques for detecting phishing sites and their targets [C ] // Distributed Computing Systems (ICDCS) . 2016 : 323 - 333 .

RAMESH G , KRISHNAMURTHI I , KUMAR K S S . An efficacious method for detecting phishing webpages through target domain identification [J ] . Decision Support Systems , 2014 , 61 : 12 - 22 .

ABRAHAM D , RAJ N S . Approximate string matching algorithm for phishing detection [C ] // Advances in Computing,Communications and Informatics . 2014 : 2285 - 2290 .

何高辉 , 邹福泰 , 谭大礼 , 等 . 基于 SVM 主动学习算法的网络钓鱼检测系统 [J ] . 计算机工程 , 2011 ,( 19 ): 126 - 128 .

HE G H , ZOU F T , TAN D L , et al . Phishing detection system based on SVM active learning algorithm [J ] . Computer Engineering , 2011 ( 19 ): 126 - 128 .

CHIEW K L , CHANG E H , TIONG W K . Utilisation of website logo for phishing detection [J ] . Computers ＆Security , 2015 , 54 : 16 - 26 .

GENG G G , LEE X D , ZHANG Y M . Combating phishing attacks via brand identity and authorization features [J ] . Security and Communication Networks , 2015 , 8 ( 6 ): 888 - 898 .

胡向东 , 刘可 , 张峰 , 等 . 基于页面敏感特征的金融类钓鱼网页检测方法 [J ] . 网络与信息安全学报 , 2016 , 2 ( 2 ): 31 - 38 .

HU X D , LIU K , ZHANG F , et al . Methods of Financial fishing Web test based on page sensitive characteristics [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 2 ): 35 - 42 .

GENG G G , LEE X D , WANG W , et al . Favicon-a clue to phishing sites detection [C ] // eCrime Researchers Summit (eCRS) . 2013 : 1 - 10 .

PAN Y , DING X . Anomaly based web phishing page detection [C ] // Computer Security Applications Conference . 2006 : 381 - 392 .

ALKHOZAE M G , BATARFI O A . Phishing websites detection based on phishing characteristics in the webpage source code [J ] . International Journal of Information and Communication Technology Research , 2011 , 1 ( 6 ).

WENYIN L , HUANG G , XIAOYUE L , et al . Detection of phishing webpages based on visual similarity [C ] // Special Interest Tracks and Posters of the 14th International Conference on World Wide Web . 2005 : 1060 - 1061 .

WENYIN L , HUANG G , XIAOYUE L , et al . Phishing Web page detection [C ] // Document Analysis and Recognition . 2005 : 560 - 564 .

张卫丰 , 周毓明 , 许蕾 , 等 . 基于匈牙利匹配算法的钓鱼网页检测方法 [J ] . 计算机学报 , 2010 ,( 10 ): 1963 - 1975 .

ZHANG W F , ZHOU Y M , XU L , et al . Financial fishing Web test based on Hungarian matching algorithm [J ] . Chinese Journal of Computers , 2010 ( 10 ): 1963 - 1975 .

邹学强 , 张鹏 , 黄彩云 , 等 . 基于页面布局相似性的钓鱼网页发现方法 [J ] . 通信学报 , 2016 ( S1 ): 116 - 124 .

ZOU X Q , ZHANG P , HUANG C Y , et al . Detecting methods of phshing Web based on the page layout [J ] . Journal on Comunications , 2016 ( S1 ): 116 - 124 .

FU A Y , WENYIN L , DENG X . Detecting phishing Web pages with visual similarity assessment based on earth mover's distance (EMD) [J ] . IEEE transactions on dependable and secure computing , 2006 , 3 ( 4 ).

曹玖新 , 毛波 , 罗军舟 , 等 . 基于嵌套EMD的钓鱼网页检测算法 [J ] . 计算机学报 , 2009 ,( 5 ): 922 - 929 .

CAO J X , MAO B , LUO J Z , et al . Financial fishing Web test based on nesting EMD [J ] . Journal of Computers , 2009 ( 5 ): 922 - 929 .

TAN C L , CHIEW K L . Phishing website detection using URL-assisted brand name weighting system [C ] // Intelligent Signal Processing and Communication Systems (ISPACS) . 2014 : 54 - 59 .

ZHANG Y , HONG J I , CRANOR L F . Cantina:a content-based approach to detecting phishing web sites [C ] // The 16th International Conference on World Wide Web . 2007 : 639 - 648 .

YAN Z , LIU S , WANG T , et al . A genetic algorithm based model for chinese phishing e-commerce websites detection [C ] // The International Conference on HCI in Business,Government and Organizations . 2016 : 270 - 279 .

赵加林 . 基于K-Means和SVM的流行中文钓鱼网站识别研究 [J ] . 软件导刊 , 2016 ( 4 ): 176 - 178 .

ZHAO J L . Study of popular Chinese phshing site identification based on K-Means and SVM [J ] . Software Guide , 2016 ( 4 ): 176 - 178 .

ZHANG W , JIANG Q , CHEN L , et al . Two-stage ELM for phishing Web pages detection using hybrid features [J ] . World Wide Web , 2016 : 1 - 17 .

徐欢潇 , 徐慧 , 雷丽婷 . 多特征分类识别算法融合的网络钓鱼识别技术 [J ] . 计算机应用研究 , 2017 ( 4 ): 1129 - 1132 .

XU H X , XU H , LEI L T . Phishing identification technology with multiple feature classification recognition algorithm [J ] . Application Research of Computers , 2017 ( 4 ): 1129 - 1132 .

PhishTank [EB/OL ] . http://www.phishtank.com/ http://www.phishtank.com/ .

Millersmiles [EB/OL ] . http://www.millersmiles.co.uk/ http://www.millersmiles.co.uk/ .

Spamassassin public corpus [EB/OL ] . http://spamassassin.apache.org/publiccorpus/ http://spamassassin.apache.org/publiccorpus/ .

MalwarePatrol [EB/OL ] . http://www.malwarepatrol.com/ http://www.malwarepatrol.com/ .

Open directory [EB/OL ] . http://www.dmoz.org/ http://www.dmoz.org/ .

Open directory project [EB/OL ] . https://zh.wikipedia.org/wiki/ https://zh.wikipedia.org/wiki/ .

ABU-NIMEH S , NAPPA D , WANG X , et al . A comparison of machine learning techniques for phishing detection [C ] // The anti-phishing working groups 2nd annual eCrime researchers summit . 2007 : 60 - 69 .

Spamhaus [EB/OL ] . https://www.spamhaus.org/ https://www.spamhaus.org/ .

SURBL [EB/OL ] . http://www.surbl.org/lists http://www.surbl.org/lists .

Google safe browsing api [EB/OL ] . https://www.google.com/transparencyreport/safebrowsing/ https://www.google.com/transparencyreport/safebrowsing/ .

PRAKASH P , KUMAR M , KOMPELLA R R , et al . Phishnet:predictive blacklisting to detect phishing attacks [C ] // INFOCOM . 2010 : 1 - 5 .

FELEGYHAZI M , KREIBICH C , PAXSON V . On the potential of proactive domain blacklisting [J ] . LEET , 2010 , 10 : 6 .

KHONJI M , IRAQI Y , JONES A . Phishing detection:a literature survey [J ] . IEEE Communications Surveys ＆Tutorials , 2013 , 15 ( 4 ): 2091 - 2121 .

SHENG S , WARDMAN B , WARNER G , et al . An empirical analysis of phishing blacklists [C ] // The 6th Conference on Email and Anti-Spam (CEAS) . 2009 .

FLORÊNCIO D , HERLEY C . Analysis and improvement of anti-phishing schemes [C ] // IFIP International Information Security Conference . 2006 : 148 - 157 .

LIN I C , CHI Y L , CHUANG H C , et al . The novel features for phishing based on user device detection [J ] . JCP , 2016 , 11 ( 2 ): 109 - 115 .

JAIN A K , GUPTA B B . Phishing detection:analysis of visual similarity based approaches [J ] . Security and Communication Networks , 2017 ( 4 ): 1 - 20 .

BREIMAN L . Random forests [J ] . Machine Learning , 2001 , 45 ( 1 ): 5 - 32 .

PLATT J C . 12 fast training of support vector machines using sequential minimal optimization [J ] . Advances in Kernel Methods , 1999 : 185 - 208 .

QUINLAN J R . C4.5:programs for machine learning [M ] . Elsevier , 2014 .

JOHN G H , LANGLEY P . Estimating continuous distributions in Bayesian classifiers [C ] // The Eleventh Conference on Uncertainty in Artificial Intelligence . 1995 : 338 - 345 .

ABU-NIMEH S , NAPPA D , WANG X , et al . A comparison of machine learning techniques for phishing detection [C ] // The anti-phishing Working Groups 2nd Annual eCrime Researchers Summit . 2007 : 60 - 69 .

XIANG G , HONG J , ROSE C P , et al . Cantina+:A feature-rich machine learning framework for detecting phishing Web sites [J ] . ACM Transactions on Information and System Security (TISSEC) , 2011 , 14 ( 2 ): 21 .

MOGHIMI M , VARJANI A Y . New rule-based phishing detection method [J ] . Expert Systems with Applications , 2016 , 53 : 231 - 242 .

LIU G , QIU B , WENYIN L . Automatic detection of phishing target from phishing webpage [C ] // The 20th International Conference on Pattern Recognition (ICPR) . 2010 : 4153 - 4156 .

VERMA R , SHASHIDHAR N , HOSSAIN N . Detecting phishing emails the natural language way [C ] // European Symposium on Research in Computer Security . 2012 : 824 - 841 .

MICRO T . Mobile phishing:a problem on the horizon [EB/OL ] . https://www.yumpu.com/en/document/view/10210640/rpt-monthlymobile-review-201302-mobile-phishing-a-problem-on-the-horizon https://www.yumpu.com/en/document/view/10210640/rpt-monthlymobile-review-201302-mobile-phishing-a-problem-on-the-horizon .

JEONG S Y , KOH Y S , DOBBIE G . Phishing detection on Twitter streams [C ] // Pacific-Asia Conference on Knowledge Discovery and Data Mining . 2016 : 141 - 153 .

ALBANESIUS C . Gaming apps increase spam,phishing by 50 percent [EB/OL ] . http://www.pcmag.com/article2/0,2817,2362134,00.asp http://www.pcmag.com/article2/0,2817,2362134,00.asp , 2010 .

VIDAS T , OWUSU E , WANG S , et al . QRishing:the susceptibility of smartphone users to QR code phishing attacks [C ] // The International Conference on Financial Cryptography and Data Security . 2013 : 52 - 69 .

SARIKA S , PAUL V . Parallel phishing attack recognition using software agents [J ] . Journal of Intelligent ＆Fuzzy Systems , 2017 , 32 ( 5 ): 3273 - 3284 .

CHHABRA S , AGGARWAL A , BENEVENUTO F , et al . Phi.sh/$ ocial:the phishing landscape through short urls [C ] // The 8th Annual Collaboration,Electronic messaging,Anti-Abuse and Spam Conference . 2011 : 92 - 101 .

沙泓州 , 刘庆云 , 柳厅文 , 等 . 恶意网页识别研究综述 [J ] . 计算机学报 , 2016 ( 3 ): 529 - 542 .

SHA H Z , LIU Q Y , LIU T W , et al . Review of malicious Web recognition [J ] . Journal of Computers , 2016 ( 3 ): 529 - 542 .

Views

9003

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Personal data privacy protection method based onvertical partitioning

Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis

Related Author

ZUO Peng

CHEN Yong

KONG Kaichuan

HE Ming

HOU Ronghao

DONG Weiyu

TANG Yonghe

LIU Chunling

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

School of Medical Information, Wannan Medical College

School of Physics and Electronic Information, Anhui Normal University

⁰