网络钓鱼欺诈检测技术研究

张茜; 延志伟; 李洪涛; 耿光刚

doi:10.11959/j.issn.2096-109x.2017.00180

您当前的位置：

首页 >

文章列表页 >

网络钓鱼欺诈检测技术研究

综述 | 更新时间：2024-06-03

- 网络钓鱼欺诈检测技术研究
- Research of phishing detection technology
- 网络与信息安全学报 2017年3卷第7期页码：7-24
- 作者机构：
  
  1. 中国科学院计算机网络信息中心，北京 100190
  2. 中国科学院大学，北京 100049
  3. 中国互联网络信息中心互联网域名管理技术国家工程实验室，北京 100190
- 作者简介：
  
  [ "张茜（1994-），女，河南杞县人，中国科学院大学硕士生，主要研究方向为网络应用与安全、下一代互联网技术。" ]
  [ "延志伟（1985-），男，山西兴县人，博士，中国互联网络信息中心副研究员，主要研究方向为IPv6移动性管理、BGP安全机制、信息中心网络架构。" ]
  [ "李洪涛（1977-），男，河北保定人，中国互联网络信息中心高级工程师、总工程师，主要研究方向为 IPv6、网络安全、大数据。" ]
  [ "耿光刚（1980-），男，山东泰安人，博士，中国互联网络信息中心研究员，主要研究方向为机器学习、大数据分析和互联网基础资源安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61375039)
- DOI：10.11959/j.issn.2096-109x.2017.00180
  中图分类号： TP393
- 网络首发：2017-07，
  
  纸质出版：2017-07-15
- 稿件说明：
移动端阅览
张茜, 延志伟, 李洪涛, 等. 网络钓鱼欺诈检测技术研究[J]. 网络与信息安全学报, 2017,3(7):7-24.

Xi ZHANG, Zhi-wei YAN, Hong-tao LI, et al. Research of phishing detection technology[J]. Chinese Journal of Network and Information Security, 2017, 3(7): 7-24.
张茜, 延志伟, 李洪涛, 等. 网络钓鱼欺诈检测技术研究[J]. 网络与信息安全学报, 2017,3(7):7-24. DOI： 10.11959/j.issn.2096-109x.2017.00180.

Xi ZHANG, Zhi-wei YAN, Hong-tao LI, et al. Research of phishing detection technology[J]. Chinese Journal of Network and Information Security, 2017, 3(7): 7-24. DOI： 10.11959/j.issn.2096-109x.2017.00180.

摘要

分析了网络钓鱼欺诈的现状，并对钓鱼检测常用的数据集和评估指标进行了总结。在此基础上，综述了网络钓鱼检测方法，包括黑名单策略、启发式方法、视觉匹配方法、基于机器学习的方法和基于自然语言理解的方法等，对比分析了各类方法的优缺点，进一步指出了钓鱼检测面临的挑战，并展望了钓鱼检测未来的研究趋势。

Abstract

The current status of phishing scams were analyzed and the data sets and evaluation indicators commonly used in phishing detection were summaried.On this basis

a detailed overview of the typical methods of phishing detection was given

which included blacklist strategies

heuristic methods

visual matching methods

and methods based on machine learning and natural language processing.The comparison and analysis of those methods were given

and furtherly

the challenges and future trends of phishing detection were discussed.

关键词

Keywords

references

国家网络空间安全战略 [EB/OL ] . http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm .

National cybersecurity strategy [EB/OL ] . http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm http://news.xinhuanet.com/politics/2016-12/27/c1120196479.htm .

Anti-Phishing Working Group(APWG) . Phishing activity trends report-second quarter 2016 [EB/OL ] . https://docs.apwg.org/reports/apwgtrendsreportq22016.pdf https://docs.apwg.org/reports/apwgtrendsreportq22016.pdf .

WEIDER D Y , NARGUNDKAR S , TIRUTHANI N . A phishing vulnerability analysis of web based systems [C ] // Computers and Communications . 2008 : 326 - 331 .

E.M.C.Corporation . RSA monthly fraud report [EB/OL ] . http://australia.emc.com/collateral/fraud-report/h13929-rsa-fraud-report-jan-2015.pdf http://australia.emc.com/collateral/fraud-report/h13929-rsa-fraud-report-jan-2015.pdf .

中国反钓鱼网站联盟 . 2012年中国反钓鱼网站联盟年报 [EB/OL ] . http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf .

APAC . Coalition against phishing site report of China in 2012 [EB/OL ] . http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf http://apac.cn/gzdt/qwfb/201408/P020140826493067614020.pdf .

中国反钓鱼网站联盟 . 2016年9月钓鱼网站处理简报 [EB/OL ] . http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf .

APAC . Phishing site processing presentation in september 2016 [EB/OL ] . http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf http://apac.cn/gzdt/qwfb/201610/P020161110519501201415.pdf .

中国反钓鱼网站联盟 . 中国反钓鱼网站联盟.2015年12月钓鱼网站处理简报 [EB/OL ] . http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf .

APAC . Phishing site processing presentation in september 2015 [EB/OL ] . http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf http://apac.cn/gzdt/qwfb/201601/P020160108491677785300.pdf .

HAN Y F , SHEN Y . Accurate spear phishing campaign attribution and early detection [C ] // The 31st Annual ACM Symposium on Applied Computing . 2016 : 2079 - 2086 .

ALARM S , EL-KHATIB K , . Phishing susceptibility detection through social media analytics [C ] // The 9th International Conference on Security of Information and Networks . 2016 : 61 - 64 .

Krebs on security [EB/OL ] . https://krebsonsecurity.com/2016/04/fbi-2-3-billion-lost-to-ceo-email-scams/ https://krebsonsecurity.com/2016/04/fbi-2-3-billion-lost-to-ceo-email-scams/ .

Anti-Phishing Working Group(APWG) . Global phishing survey:trends and domainname use in 2H2014 [EB/OL ] . http://docs.apwg.org/reports/APWGGlobalPhishingReport2H2014.pdf http://docs.apwg.org/reports/APWGGlobalPhishingReport2H2014.pdf .

YAN G , EIDENBENZ S , GALLI E . Sms-watchdog:profiling social behaviors of SMS users for anomaly detection [C ] // The International Workshop on Recent Advances in Intrusion Detection . 2009 : 202 - 223 .

NASSAR M , NICCOLINI S , EWALD T . Holistic VoIP intrusion detection and prevention system [C ] // The 1st International Conference on Principles,Systems and Applications of IP Telecommunications . 2007 : 1 - 9 .

SONG J , KIM H , GKELIAS A . iVisher:real-time detection of caller ID spoofing [J ] . ETRI Journal , 2014 , 36 ( 5 ): 865 - 875 .

彭富明 , 张卫丰 , 彭寅 . 基于文本特征分析的钓鱼邮件检测 [J ] . 南京邮电大学学报(自然科学版) , 2012 ( 5 ): 140 - 145 .

PENG F M , ZHANG W F , PENG Y . Detection of phishing emails based on text characteristic analysis [J ] . Journal of Nanjing University of Posts and Telecommunication , 2012 ( 5 ): 140 - 145 .

HUSÁK M , CEGAN J . PhiGARo:automatic phishing detection and incident response framework [C ] // Availability,Reliability and Security (ARES) . 2014 : 295 - 302 .

AGGARWAL S , KUMAR V , SUDARSAN S D . Identification and detection of phishing emails using natural language processing techniques [C ] // The 7th International Conference on Security of Information and Networks . 2014 :217.

AKINYELU A A , ADEWUMI A O . Classification of phishing email using random forest machine learning technique [J ] . Journal of Applied Mathematics , 2014 .

YASIN A , ABUHASAN A . An intelligent classification model for phishing email detection [J ] . 2016 , 8 ( 4 ): 55 - 72

VERMA R , RAI N . Phish-IDetector:Message-ID based automatic phishing detection [C ] // e-Business and Telecommunications (ICETE) . 2015 ( 4 ): 427 - 434

黄华军 , 钱亮 , 王耀钧 . 基于异常特征的钓鱼网站URL检测技术 [J ] . 信息网络安全 , 2012 ,( 01 ): 23 - 25 ,67.

HUANG H J , QIAN L , WANG Y J . URL Detecting technology of phshing site based on anomalous characte [J ] . Netinfo Security , 2012 ,( 1 ): 23 - 25 .

BLUM A , WARDMAN B , SOLORIO T , et al . Lexical feature based phishing URL detection using online learning [C ] // The 3rd ACM Workshop on Artificial Intelligence and Security . 2010 : 54 - 60 .

MA J , SAUL L K , SAVAGE S , et al . Identifying suspicious URLs:an application of large-scale online learning [C ] // The 26th Annual International Conference on Machine Learning . 2009 : 681 - 688 .

MA J , SAUL L K , SAVAGE S , et al . Beyond blacklists:learning to detect malicious Web sites from suspicious URLs [C ] // The 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2009 : 1245 - 1254 .

FEROZ M N , MENGEL S . Examination of data,rule generation and detection of phishing URLs using online logistic regression [C ] // 2014 IEEE International Conference on Big Data . 2014 : 241 - 250 .

FEROZ M N , MENGEL S . Phishing URL detection using URL ranking [C ] // The IEEE International Congress on Big Data . 2015 : 635 - 638 .

MARCHAL S , SAARI K , SINGH N , et al . Know your phish:Novel techniques for detecting phishing sites and their targets [C ] // Distributed Computing Systems (ICDCS) . 2016 : 323 - 333 .

RAMESH G , KRISHNAMURTHI I , KUMAR K S S . An efficacious method for detecting phishing webpages through target domain identification [J ] . Decision Support Systems , 2014 , 61 : 12 - 22 .

ABRAHAM D , RAJ N S . Approximate string matching algorithm for phishing detection [C ] // Advances in Computing,Communications and Informatics . 2014 : 2285 - 2290 .

何高辉 , 邹福泰 , 谭大礼 , 等 . 基于 SVM 主动学习算法的网络钓鱼检测系统 [J ] . 计算机工程 , 2011 ,( 19 ): 126 - 128 .

HE G H , ZOU F T , TAN D L , et al . Phishing detection system based on SVM active learning algorithm [J ] . Computer Engineering , 2011 ( 19 ): 126 - 128 .

CHIEW K L , CHANG E H , TIONG W K . Utilisation of website logo for phishing detection [J ] . Computers ＆Security , 2015 , 54 : 16 - 26 .

GENG G G , LEE X D , ZHANG Y M . Combating phishing attacks via brand identity and authorization features [J ] . Security and Communication Networks , 2015 , 8 ( 6 ): 888 - 898 .

胡向东 , 刘可 , 张峰 , 等 . 基于页面敏感特征的金融类钓鱼网页检测方法 [J ] . 网络与信息安全学报 , 2016 , 2 ( 2 ): 31 - 38 .

HU X D , LIU K , ZHANG F , et al . Methods of Financial fishing Web test based on page sensitive characteristics [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 2 ): 35 - 42 .

GENG G G , LEE X D , WANG W , et al . Favicon-a clue to phishing sites detection [C ] // eCrime Researchers Summit (eCRS) . 2013 : 1 - 10 .

PAN Y , DING X . Anomaly based web phishing page detection [C ] // Computer Security Applications Conference . 2006 : 381 - 392 .

ALKHOZAE M G , BATARFI O A . Phishing websites detection based on phishing characteristics in the webpage source code [J ] . International Journal of Information and Communication Technology Research , 2011 , 1 ( 6 ).

WENYIN L , HUANG G , XIAOYUE L , et al . Detection of phishing webpages based on visual similarity [C ] // Special Interest Tracks and Posters of the 14th International Conference on World Wide Web . 2005 : 1060 - 1061 .

WENYIN L , HUANG G , XIAOYUE L , et al . Phishing Web page detection [C ] // Document Analysis and Recognition . 2005 : 560 - 564 .

张卫丰 , 周毓明 , 许蕾 , 等 . 基于匈牙利匹配算法的钓鱼网页检测方法 [J ] . 计算机学报 , 2010 ,( 10 ): 1963 - 1975 .

ZHANG W F , ZHOU Y M , XU L , et al . Financial fishing Web test based on Hungarian matching algorithm [J ] . Chinese Journal of Computers , 2010 ( 10 ): 1963 - 1975 .

邹学强 , 张鹏 , 黄彩云 , 等 . 基于页面布局相似性的钓鱼网页发现方法 [J ] . 通信学报 , 2016 ( S1 ): 116 - 124 .

ZOU X Q , ZHANG P , HUANG C Y , et al . Detecting methods of phshing Web based on the page layout [J ] . Journal on Comunications , 2016 ( S1 ): 116 - 124 .

FU A Y , WENYIN L , DENG X . Detecting phishing Web pages with visual similarity assessment based on earth mover's distance (EMD) [J ] . IEEE transactions on dependable and secure computing , 2006 , 3 ( 4 ).

曹玖新 , 毛波 , 罗军舟 , 等 . 基于嵌套EMD的钓鱼网页检测算法 [J ] . 计算机学报 , 2009 ,( 5 ): 922 - 929 .

CAO J X , MAO B , LUO J Z , et al . Financial fishing Web test based on nesting EMD [J ] . Journal of Computers , 2009 ( 5 ): 922 - 929 .

TAN C L , CHIEW K L . Phishing website detection using URL-assisted brand name weighting system [C ] // Intelligent Signal Processing and Communication Systems (ISPACS) . 2014 : 54 - 59 .

ZHANG Y , HONG J I , CRANOR L F . Cantina:a content-based approach to detecting phishing web sites [C ] // The 16th International Conference on World Wide Web . 2007 : 639 - 648 .

YAN Z , LIU S , WANG T , et al . A genetic algorithm based model for chinese phishing e-commerce websites detection [C ] // The International Conference on HCI in Business,Government and Organizations . 2016 : 270 - 279 .

赵加林 . 基于K-Means和SVM的流行中文钓鱼网站识别研究 [J ] . 软件导刊 , 2016 ( 4 ): 176 - 178 .

ZHAO J L . Study of popular Chinese phshing site identification based on K-Means and SVM [J ] . Software Guide , 2016 ( 4 ): 176 - 178 .

ZHANG W , JIANG Q , CHEN L , et al . Two-stage ELM for phishing Web pages detection using hybrid features [J ] . World Wide Web , 2016 : 1 - 17 .

徐欢潇 , 徐慧 , 雷丽婷 . 多特征分类识别算法融合的网络钓鱼识别技术 [J ] . 计算机应用研究 , 2017 ( 4 ): 1129 - 1132 .

XU H X , XU H , LEI L T . Phishing identification technology with multiple feature classification recognition algorithm [J ] . Application Research of Computers , 2017 ( 4 ): 1129 - 1132 .

PhishTank [EB/OL ] . http://www.phishtank.com/ http://www.phishtank.com/ .

Millersmiles [EB/OL ] . http://www.millersmiles.co.uk/ http://www.millersmiles.co.uk/ .

Spamassassin public corpus [EB/OL ] . http://spamassassin.apache.org/publiccorpus/ http://spamassassin.apache.org/publiccorpus/ .

MalwarePatrol [EB/OL ] . http://www.malwarepatrol.com/ http://www.malwarepatrol.com/ .

Open directory [EB/OL ] . http://www.dmoz.org/ http://www.dmoz.org/ .

Open directory project [EB/OL ] . https://zh.wikipedia.org/wiki/ https://zh.wikipedia.org/wiki/ .

ABU-NIMEH S , NAPPA D , WANG X , et al . A comparison of machine learning techniques for phishing detection [C ] // The anti-phishing working groups 2nd annual eCrime researchers summit . 2007 : 60 - 69 .

Spamhaus [EB/OL ] . https://www.spamhaus.org/ https://www.spamhaus.org/ .

SURBL [EB/OL ] . http://www.surbl.org/lists http://www.surbl.org/lists .

Google safe browsing api [EB/OL ] . https://www.google.com/transparencyreport/safebrowsing/ https://www.google.com/transparencyreport/safebrowsing/ .

PRAKASH P , KUMAR M , KOMPELLA R R , et al . Phishnet:predictive blacklisting to detect phishing attacks [C ] // INFOCOM . 2010 : 1 - 5 .

FELEGYHAZI M , KREIBICH C , PAXSON V . On the potential of proactive domain blacklisting [J ] . LEET , 2010 , 10 : 6 .

KHONJI M , IRAQI Y , JONES A . Phishing detection:a literature survey [J ] . IEEE Communications Surveys ＆Tutorials , 2013 , 15 ( 4 ): 2091 - 2121 .

SHENG S , WARDMAN B , WARNER G , et al . An empirical analysis of phishing blacklists [C ] // The 6th Conference on Email and Anti-Spam (CEAS) . 2009 .

FLORÊNCIO D , HERLEY C . Analysis and improvement of anti-phishing schemes [C ] // IFIP International Information Security Conference . 2006 : 148 - 157 .

LIN I C , CHI Y L , CHUANG H C , et al . The novel features for phishing based on user device detection [J ] . JCP , 2016 , 11 ( 2 ): 109 - 115 .

JAIN A K , GUPTA B B . Phishing detection:analysis of visual similarity based approaches [J ] . Security and Communication Networks , 2017 ( 4 ): 1 - 20 .

BREIMAN L . Random forests [J ] . Machine Learning , 2001 , 45 ( 1 ): 5 - 32 .

PLATT J C . 12 fast training of support vector machines using sequential minimal optimization [J ] . Advances in Kernel Methods , 1999 : 185 - 208 .

QUINLAN J R . C4.5:programs for machine learning [M ] . Elsevier , 2014 .

JOHN G H , LANGLEY P . Estimating continuous distributions in Bayesian classifiers [C ] // The Eleventh Conference on Uncertainty in Artificial Intelligence . 1995 : 338 - 345 .

ABU-NIMEH S , NAPPA D , WANG X , et al . A comparison of machine learning techniques for phishing detection [C ] // The anti-phishing Working Groups 2nd Annual eCrime Researchers Summit . 2007 : 60 - 69 .

XIANG G , HONG J , ROSE C P , et al . Cantina+:A feature-rich machine learning framework for detecting phishing Web sites [J ] . ACM Transactions on Information and System Security (TISSEC) , 2011 , 14 ( 2 ): 21 .

MOGHIMI M , VARJANI A Y . New rule-based phishing detection method [J ] . Expert Systems with Applications , 2016 , 53 : 231 - 242 .

LIU G , QIU B , WENYIN L . Automatic detection of phishing target from phishing webpage [C ] // The 20th International Conference on Pattern Recognition (ICPR) . 2010 : 4153 - 4156 .

VERMA R , SHASHIDHAR N , HOSSAIN N . Detecting phishing emails the natural language way [C ] // European Symposium on Research in Computer Security . 2012 : 824 - 841 .

MICRO T . Mobile phishing:a problem on the horizon [EB/OL ] . https://www.yumpu.com/en/document/view/10210640/rpt-monthlymobile-review-201302-mobile-phishing-a-problem-on-the-horizon https://www.yumpu.com/en/document/view/10210640/rpt-monthlymobile-review-201302-mobile-phishing-a-problem-on-the-horizon .

JEONG S Y , KOH Y S , DOBBIE G . Phishing detection on Twitter streams [C ] // Pacific-Asia Conference on Knowledge Discovery and Data Mining . 2016 : 141 - 153 .

ALBANESIUS C . Gaming apps increase spam,phishing by 50 percent [EB/OL ] . http://www.pcmag.com/article2/0,2817,2362134,00.asp http://www.pcmag.com/article2/0,2817,2362134,00.asp , 2010 .

VIDAS T , OWUSU E , WANG S , et al . QRishing:the susceptibility of smartphone users to QR code phishing attacks [C ] // The International Conference on Financial Cryptography and Data Security . 2013 : 52 - 69 .

SARIKA S , PAUL V . Parallel phishing attack recognition using software agents [J ] . Journal of Intelligent ＆Fuzzy Systems , 2017 , 32 ( 5 ): 3273 - 3284 .

CHHABRA S , AGGARWAL A , BENEVENUTO F , et al . Phi.sh/$ ocial:the phishing landscape through short urls [C ] // The 8th Annual Collaboration,Electronic messaging,Anti-Abuse and Spam Conference . 2011 : 92 - 101 .

沙泓州 , 刘庆云 , 柳厅文 , 等 . 恶意网页识别研究综述 [J ] . 计算机学报 , 2016 ( 3 ): 529 - 542 .

SHA H Z , LIU Q Y , LIU T W , et al . Review of malicious Web recognition [J ] . Journal of Computers , 2016 ( 3 ): 529 - 542 .

浏览量

9003

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法

基于垂直分割的个人数据隐私保护方法

基于时空行为与静态属性分析的陌陌应用恶意用户检测方法