网络钓鱼识别研究综述

doi:10.11959/j.issn.2096-109x.2020062

Abstract

Abstract:

With the continuous development of the internet,the threat posed by phishing to people's daily lives is increasing.As a core security technology against phishing attacks,phishing detection technology can help people effectively avoid security threats caused by phishing attacks.Firstly,starting with the basic concepts of phishing,the current application scenarios of phishing identification were summarized.Then,the research status of phishing identification technology in detail were analyzed.Finally,possible future research directions were discussed.

Key words: phishing detection, machine learning, text classification, feature selection

CLC Number:

TN915

Xi FU,Hui LI,Xingwen ZHAO. Survey on phishing detection research[J]. Chinese Journal of Network and Information Security, 2020, 6(5): 1-10.

Figures/Tables 3

References 75

[1]	BLEAU H . 2017 Global fraud and cybercrime forecast[EB].
[2]	Phishing activity trends report 3rd quarter 2019[R].
[3]	王惟 . 反钓鱼技术综述[J]. 山东广播电视大学学报, 2011(3): 45-46,49.
	WANG W . Review of anti-phishing technology[J]. Journal of Shandong Radio and TV University, 2011(3): 45-46,49.
[4]	李江丰, 王玮 . 钓鱼网站的识别与分析方法研究[J]. 通信管理与技术, 2018(3): 62-64.
	LI J F , WANG W . Research on recognition and analysis methods of phishing websites[J]. Communications Management and Technol-ogy, 2018(3): 62-64
[5]	沙泓州, 刘庆云, 柳厅文 ,等. 恶意网页识别研究综述[J]. 计算机学报, 2016(3): 529-542.
	SHA H Z , LIU Q Y , LIU T W.et al . Review of malicious web rec-ognition[J]. Journal of Computers, 2016(3): 529-542.
[6]	Google safe browsing APIs[EB].
[7]	HAN W , CAO Y , BERTINO E ,et al. Using automated individual white-list to protect web digital identities[J]. Expert Systems with Applications, 2012,39(15).
[8]	PRAKASH P , KUMAR M , KOMPELLA R R ,et al. PhishNet:predictive blacklisting to detect phishing attacks[C]// 29th INFOCOM. 2010
[9]	ZHANG J , PORRAS P A , ULLRICH J . Highly predictive blacklisting[C]// 17th USENIX Security Symposium 2008.
[10]	SHENG S , WARDMAN B , WARNER G ,et al. An empirical analysis of phishing blacklists[C]// The 6th Conf.Email Anti-Spam (CEAS)
[11]	GASTELLIER-PREVOST S , GRANADILLO G G , LAURENT M . Decisive heuristics to differentiate legitimate from phishing sites[C]// Network ＆ Information Systems Security. 2011.
[12]	KANG L C , CHANG E H , SZE S N ,et al. Utilisation of website logo for phishing detection[J]. Computers ＆ Security, 2015(54): 16-26.
[13]	DUNLOP M , GROAT S , SHELLY D . GoldPhish:using images for content-based phishing analysis[C]// Fifth International Conference on Internet Monitoring ＆ Protection. 2010.
[14]	HUH J H , KIM H . Phishing detection with popular search engines:simple and effective[M]// Foundations and Practice of Security. Berlin Heidelberg:Springer, 2011.
[15]	JAIN A K , GUPTA B B . Two-level authentication approach to protect from phishing attacks in real time[J]. Ambient Intelligence and Humanized Computing, 2018,9(6): 1783-1796.
[16]	TAN C L , KANG L C , WONG K S ,et al. PhishWHO:phishing webpage detection via identity keywords extraction and target domain name finder[J]. Decision Support Systems, 2016(88): 18-27.
[17]	VARSHNEY G , MISRA M , ATREY P K . Improving the accuracy of search engine based anti-phishing solutions using lightweight features[C]// 11th ICITST 2016.
[18]	ZHANG Y , HONG J I , CRANOR L F . Cantina:a content-based approach to detecting phishing web sites[C]// 16th WWW, 2007.
[19]	RAO R S , PAIS A R . Jail-phish:an improved search engine based phishing detection system[J]. Computers ＆ Security, 2019(83): 246-267.
[20]	LE A , MARKOPOULOU A , FALOUTSOS M . PhishDef.URL names say it all[J]. CoRR abs/1009.2275, 2010
[21]	MA J , SAUL L K , SAVAGE S ,et al. Beyond blacklists:learning to detect malicious Web sites from suspicious URLs[C]// KDD. 2009.
[22]	YUAN H , CHEN X , LI Y ,et al. Detecting phishing websites and targets based on URLs and webpage links[C]// 24th ICPR 2018.
[23]	GARERA S , PROVOS N , CHEW M ,et al. A framework for detection and measurement of phishing attacks[C]// ACM Workshop on Recurring Malcode. 2007.
[24]	MC-GRATH D K , GUPTA M . Behind phishing:an examination of phisher modi operandi[C]// 5th NSDI 2008.
[25]	LI Y , YANG Z , XU C ,et al. A stacking model using URL and HTML features for phishing webpage detection[J]. Future Generation Comp Syst, 2019(94): 27-39.
[26]	SAHINGOZ O K , BUBER E , DEMIR O ,et al. Machine learning based phishing detection from URLs[J]. Expert Syst Appl, 2019(117): 345-357.
[27]	YANG W , ZUO W , CUI B . Detecting malicious URLs via a keyword-based convolutional gated-recurrent-unit neural network[J]. IEEE Access, 2019(7): 29891-29900.
[28]	YANG P , ZHAO G , ZENG P . Phishing website detection based on multidimensional features driven by deep learning[J]. IEEE Access, 2019(7): 15196-15209.
[29]	MARCHAL S , ARMANO G , GRONDAHL T ,et al. Off-the-hook:an efficient and usable client-side phishing prevention application[J]. IEEE Trans.Computers, 2017,66(10): 1717-1733.
[30]	RAO R S , PAIS A R . Detection of phishing websites using an efficient feature-based machine learning framework[J]. Neural Computing and Applications, 2019,31(8): 3851-3873.
[31]	SHIRAZI H , BEZAWADA B , RAY I.Unbiased phishing detection using domain name based features . [C]// SACMAT. 2018.
[32]	MARCHAL S , SAARI K , SINGH N ,et al. Know your phish:novel techniques for detecting phishing sites and their targets[C]// 36th ICDCS. 2016.
[33]	RAMESH G , KRISHNAMURTHI I , KUMAR K S S . An efficacious method for detecting phishing webpages through target domain identification[J]. Decision Support Systems, 2014,61: 12-22.
[34]	XIANG G , HONG J I , ROSé C P ,et al. CANTINA+:a feature-rich machine learning framework for detecting phishing web sites[J]. ACM Trans Inf Syst Secur, 2011,14(2): 21:1-21:28.
[35]	FATT J C S , LENG C K , NAH S S . Phishdentity:leverage website favicon to offset polymorphic phishing website[C]// ARES. 2014.
[36]	CHIEW K L , CHOO J S F , SZE S N ,et al. Leverage website favicon to detect phishing websites[J]. Security and Communication Networks, 2018:11.
[37]	周诚诚, 张代远 . 利用图像识别技术过滤海量可疑钓鱼网站[J]. 计算机技术与发展, 2012(11): 246-249.
	ZHOU C C , ZHANG D Y . Using image recognition technology to filter mass suspicious phishing sites[J]. Computer Technology and Development, 2012(11): 246-249.
[38]	肖洪云 . 图像识别在钓鱼检测中的应用[J]. 沧州师范学院学报, 2012(3): 75-79.
	XIAO H Y . The application of image recognition to the fishing de-tection[J]. Journal of Cangzhou Normal University, 2012(3): 75-79.
[39]	HARA , YAMADA , MIYAKE .Visual similarity-based phishing detection without victim site information[C]// ICICS. 2009.
[40]	FANG Y , HUANG C , LIU L ,et al. Research on malicious JavaScript detection technology based on LSTM[J]. IEEE Access, 2018,6: 59118-59125.
[41]	DONG Z , KAPADIA A , BLYTHE J ,et al. Beyond the lock icon:real-time detection of phishing websites using public key certificates[C]// eCrime. 2015.
[42]	MENSAH P , BLANC G , OKADA K ,et al. AJNA:anti-phishing JS-based visual analysis,to mitigate users' excessive trust in SSL/TLS[C]// 4th BADGERS@RAID. 2015.
[43]	DRURY V , MEYER U . Certified phishing:taking a look at public key certificates of phishing websites[C]// 15th SOUPS @ USENIX Security Symposium. 2019.
[44]	胡向东, 刘可, 张峰 ,等. 基于页面敏感特征的金融类钓鱼网页检测方法[J]. 网络与信息安全学报, 2017(2): 35-42.
	HU X D , LIU K , ZHANG F ,et al. Financial phishing detection method based on sensitive characteristics of webpage[J]. Chinese Journal of Network and Information Security, 2017(2): 35-42.
[45]	方勇, 龙啸, 黄诚 ,等. 基于LSTM与随机森林混合构架的钓鱼网站识别研究[J]. 四川大学学报（工程科学版）, 2018(5).
	FANG Y , LONG X , HUANG C ,et al. Research on classifying phishing URLS using hybrid architecture of LSTM and random forest[J]. Advanced Engineering Sciences, 2018(5).
[46]	CHIEW K L , TAN C L , WONG K ,et al. A new hybrid ensemble feature selection framework for machine learning-based phishing detection system[J]. Inf Sci, 2019,484: 153-166.
[47]	BABAGOLI M , AGHABABA M P , SOLOUK V . Heuristic nonlinear regression strategy for detecting phishing websites[J]. Soft Comput, 2019,23(12): 4315-4327.
[48]	Phishing activity trends report 4th quarter 2016[EB].
[49]	Phishing activity trends report 1st-3rd quarter 2015[EB].
[50]	Microsoft security intelligence report[R]. 2018.
[51]	王晓丽 . 钓鱼邮件攻击防范指南[J]. 计算机与网络, 2018,581(13): 56-57.
	WANG X L . Guidelines for preventing phishing email attacks[J].Computer ＆ Network2018,581(13):56-57. 计算机与网络, 2018,581(13): 56-57.
[52]	GASCON H , ULLRICH S , STRITTER B ,et al. Reading between the lines:content-agnostic detection of spear-phishing emails[C]// 21st RAID. 2018.
[53]	SMADI S , ASLAM N , ZHANG L . Detection of online phishing email using dynamic evolving neural network based on reinforcement learning[J]. Decision Support Systems, 2018,107: 88-102.
[54]	FANG Y , ZHANG C , HUANG C ,et al. Phishing email detection using improved RCNN model with multilevel vectors and attention mechanism[J]. IEEE Access, 2019,7: 56329-56340.
[55]	高一男, 蔡满春 . 基于 Hadoop 和 Mahout 的钓鱼邮件检测技术研究[J]. 电脑知识与技术, 2016,12(11): 27-30.
	GAO Y N , CAI M C . Research of phishing-mail detection based on Hadoop and Mahout[J]. Computer Knowledge and Technology, 2016,12(11): 27-30.
[56]	AGGARWAL A , RAJADESINGAN A , KUMARAGURU P . PhishAri:automatic realtime phishing detection on Twitter[J]. CoRR abs/1301.6899, 2013
[57]	SHARMA N , SHARMA N , TIWARI V ,et al. Real-time detection of phishing Tweets[C]// The Fourth International Conference on Computer Science,Engineering and Applications. 2014.
[58]	LIEW S W , SANI N F M , ABDULLAH M T ,et al. An effective security alert mechanism for real-time phishing tweet detection on twitter[J]. Computers ＆ Security, 2019
[59]	石春宏 . 移动终端如何识别钓鱼手段与防范[J]. 电脑知识与技术, 2017(31): 43-44.
	SHI C H . How to identify and prevent phishing on mobile termin-als[J]. Computer Knowledge and Technology, 2017(31): 43-44.
[60]	BICAKCI K , UNAL D , ASCIOGLU N ,et al. Mobile authentication secure against man-in-the-middle attacks[C]// 2nd Mobile Cloud 2014,
[61]	GOEL D , JAIN A K . Mobile phishing attacks and defence mechanisms:state of art and open research challenges[J]. Computers ＆Security, 2018,73: 519-544.
[62]	WU L , DU X , WU J . Effective defense schemes for phishing attacks on mobile computing platforms[J]. IEEE Trans Vehicular Technology, 2016,65(8): 6678-6691.
[63]	VIRVILIS N , TSALIS N , MYLONAS A ,et al. Mobile devices:a phisher′s paradise[C]// 11th International Conference on Security and Cryptography. 2014.
[64]	段青 . 一种移动平台钓鱼攻击的解决方法[J]. 信息安全与技术, 2016,7(4): 50-54.
	DUAN Q . A solution for phishing attackon Android platform[J]. Cyberspace Security, 2016,7(4): 50-54.
[65]	NDIBWILE J D , KADOBAYASHI Y , FALL D . UnPhishMe:phishing attack detection by deceptive login simulation through an android mobile App[C]// 12th AsiaJCIS. 2017.
[66]	LIU D , LIU D , LI Y ,et al. Efficient Android phishing detection based on improved na?ve bayes algorithm[C]// 10th ICSI. 2019.
[67]	刘永明, 杨婧 . 基于图像相似性的Android钓鱼恶意应用检测方法[J]. 计算机系统应用, 2014,23(12): 170-175.
	LIU Y M , YANG J . Detection of android phishing malwares based on image similarity[J]. Computer Systems ＆ Applications, 2014,23(12): 170-175.
[68]	DING Y , LUKTARHAN N , LI K ,et al. A keyword-based combination approach for detecting phishing webpages[J]. Computers ＆Security, 2019,84: 256-275.
[69]	ADEBOWALE M A , LWIN K T,SáNCHEZ E ,et al. Intelligent web-phishing detection and protection scheme using integrated features of images,frames and text[J]. Expert Syst Appl, 2019,115: 300-313.
[70]	ABUTAIR H , BELGHITH A , ALAHMADI S . CBR-PDS:a case-based reasoning phishing detection system[J]. Journal of Ambient Intelligence and Humanized Computing, 2019,10(7): 2593-2606.
[71]	HE M , HORNG S J , FAN P ,et al. An efficient phishing webpage detector[J]. Expert Syst Appl, 2011,38(10): 12018-12027.
[72]	MOHAMMAD R M , THABTAH F , MCCLUSKEY L . An assessment of features related to phishing websites using an automated technique[C]// 7th ICITST. 2012.
[73]	FALCONIERI V . Open dataset of phishing and tor hidden services screen-captures[J]. CoRR abs/1908.02449, 2019
[74]	张茜, 延志伟, 李洪涛 ,等. 网络钓鱼欺诈检测技术研究[J]. 网络与信息安全学报, 2017,3(7): 11-28.
	ZHANG X , YAN Z W , LI H T.et al . Research of phishing detection technology[J]. Chinese Journal of Network and Information Secu-rity, 2017,3(7): 11-28.
[75]	SHIRAZI H , BEZAWADA B , RAY I ,et al. Adversarial sampling attacks against phishing detection[M]// Data and Applications Security and Privacy.Berlin:Springer. 2019.

Metrics

Recommended 0

No Suggested Reading articles found!

典型工作	识别方法			评价指标
典型工作	基于列表基于列表	启发式	机器学习	准确率	FNR	FPR	时间
Google API^[6]	√√			—	—	—	0.08 s
PhishNet^[8]	√	√		—	3%	5%	0.001 s
CANTINA^[18]		√		95％	—	6%	—
Phishark^[11]		√		—	—	2.4%	2s
Website logo method^[12]		√		93.4％	0.2%	13%	—
SHLR^[68]		√	√	98.9％	—	—	0.029 ms
URLs based method^[22]			√	98.3％	—	2.6%	—
CGRU^[27]			√	99.6％	—	—	640.78 s
MFPD^[28]			√	98.99％	—	0.59％	—
PEDS^[53]			√	98.63％	0.93％	1.81％	—
THEMIS^[54]			√	99.85％	0.128%	0.043％	—
PhishAri^[56]			√	92.52％	7.78%	9.6%	0.425 s
Twitter phishing^[58]			√	94.75％	5.12%	5.3%	—
HEFS^[46]			√	94.6％	—	—	0.052 ms

典型方法	方法	算法	数据集大小	特征	准确率
URLs based method^[22]	ML	DF	6 197	12个URL特征	97.7%
		KNN			90.3%
		RF			96.0%
		LR			95.4%
CGRU^[27]	DL	卷积神经网络+门控递归单元	407 212	从原始URL得到语义特征	99.6%
A stacking model^[25]	DL	GBDT+XGBoost+LightGBM	49 947	8个URL特征+12个HTML特征	97.30%
			51 103		98.60%
MFPD^[28]	DL	LSTM+ XGBoost	2 010 779	24个URL特征+文本特征	99.41%
PEDS^[53]	ML	强化学习	12 326	从电子邮件提取50个特征	98.6%
THEMIS^[54]	DL	RCNN	7 781	从电子邮件的文本内容得到语义特征	99.84%
IPDPS^[69]	ML	ANFIS	11 056	22个文本特征+5个图像特征+8个框架特征	98.3%
HEFS^[46]	ML	RF	10 000	从URL和HTML源代码提取48个特征	96.17%
		C4.5			94.37%
		SVM			92.20%
		NB			84.10%

Survey on phishing detection research

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 3

References 75

Related Articles 15

Metrics

Recommended 0

[1]	Ruiqi XIA, Manman LI, Shaozhen CHEN. Identification on the structures of block ciphers using machine learning [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 79-89.
[2]	Zhao CAI, Tao JING, Shuang REN. Survey on Ethereum phishing detection technology [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 21-32.
[3]	Long DAI, Jing ZHANG, Xuefeng FAN, Xiaoyi ZHOU. NLP neural network copyright protection based on black box watermark [J]. Chinese Journal of Network and Information Security, 2023, 9(1): 140-149.
[4]	Cong YI, Jun HU. Novel continuous identity authentication method based on mouse behavior [J]. Chinese Journal of Network and Information Security, 2022, 8(5): 179-188.
[5]	Nan WEI, Lihua YIN, Hong NING, Binxing FANG. Preliminary study on the reform of machine learning teaching [J]. Chinese Journal of Network and Information Security, 2022, 8(4): 182-189.
[6]	Yu ZHANG, Binglong LI, Xuejuan LI, Heyu ZHANG. Evidence classification method of chat text based on DSR and BGRU model [J]. Chinese Journal of Network and Information Security, 2022, 8(2): 150-159.
[7]	Cheng HUANG, Mingxu SUN, Renyu DUAN, Susheng WU, Bin CHEN. Vulnerability identification technology research based on project version difference [J]. Chinese Journal of Network and Information Security, 2022, 8(1): 52-62.
[8]	Yingjun ZHANG,Ushangqi LI,Mu YANG,Haixia ZHANG,Kezhen HUANG. Survey on anomaly detection technology based on logs [J]. Chinese Journal of Network and Information Security, 2020, 6(6): 1-12.
[9]	Fan CHAO,Zhi YANG,Xuehui DU,Yan SUN. Android malware detection method based on deep neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79.
[10]	Sijia DU,Haining YU,Hongli ZHANG. Survey of text classification methods based on deep learning [J]. Chinese Journal of Network and Information Security, 2020, 6(4): 1-13.
[11]	Kang HE,Yuefei ZHU,Long LIU,Bin LU,Bin LIU. Improve the robustness of algorithm under adversarial environment by moving target defense [J]. Chinese Journal of Network and Information Security, 2020, 6(4): 67-76.
[12]	Fuxiang YUAN,Fenlin LIU,Chong LIU,Yan LIU,Xiangyang LUO. MLAR:large-scale network alias resolution for IP geolocation [J]. Chinese Journal of Network and Information Security, 2020, 6(4): 77-94.
[13]	Ziming LUO,Shubin XU,Xiaodong LIU. Scheme for identifying malware traffic with TLS data based on machine learning [J]. Chinese Journal of Network and Information Security, 2020, 6(1): 77-83.
[14]	Hui XIAO,Bin WENG,Tianqiang HUANG,Han PU,Zehui HUANG. Video inter-frame tampering detection algorithm fusing multiple features [J]. Chinese Journal of Network and Information Security, 2020, 6(1): 84-93.
[15]	Wei HUANG,Cuncai LIU,Sibo QI. LSTM network traffic prediction and link congestion warning scheme for single port and single link [J]. Chinese Journal of Network and Information Security, 2019, 5(6): 50-57.