New tackle to catch a phisher. (1st January 2014)

• Record Type: Journal Article
• Authors: Wardman, Brad; Britt, Jason; Warner, Gary
• Is Part Of: International journal of electronic security and digital forensics. Volume 6:Number 1(2014)
• Page Start: 62
• Page End: 80
• Publication Date: 2014-01-01
• Subjects: cybercrime -- forensics -- clustering -- file matching algorithms -- anti-fraud -- fraud detection -- social engineering -- provenance -- attribution -- branding -- phishing -- phisher -- electronic security and digital forensics; Computer crimes -- Periodicals; Computer crimes -- Investigation -- Periodicals; Computer security -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Information warfare -- Periodicals; 005.805
• Languages: English
• ISSNs: 1751-911X

Abstract

Organisations continue to pursue new strategies to thwart phishing attacks as well as investigate the criminals behind these scams. In order to address these issues, a novel algorithm named syntactical fingerprinting is proposed which automatically identifies phishing websites and implies the provenance of these websites using the structural components that compose the website. Syntactical fingerprinting demonstrates the ability to accurately identify newly observed phishing websites through an experiment on a custom dataset consisting of 49, 840 URLs collected over three months by the UAB phishing data mine. An additional experiment was run over a different set of website content in early 2011 which exhibits the use of syntactical fingerprinting as a distance metric for clustering phishing websites. Finally, varying the threshold value used by syntactical fingerprinting demonstrates the capability for phishing investigators to identify not only the source of phishing websites, but individual phishers as well.