A keyword-based combination approach for detecting phishing webpages. Issue 84 (July 2019)

• Record Type: Journal Article
• Authors: Ding, Yan; Luktarhan, Nurbol; Li, Keqin; Slamu, Wushour
• Is Part Of: Computers & security. Issue 84(2019)
• Page Start: 256
• Page End: 275
• Publication Date: 2019-07
• Subjects: Heuristic rule -- Machine learning -- Phishing -- Search engine -- URL obfuscation techniques; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.03.018
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: In this paper, the Search & Heuristic Rule & Logistic Regression (SHLR) combination detection method is proposed for detecting the obfuscation techniques commonly used by phishing websites and improving the filtering efficiency of legitimate webpages. The method is composed of three steps. First, the title tag content of the webpage is input as search keywords to the Baidu search engine, and the webpage is considered legal if the webpage domain matches the domain name of any of the top-10 search results; otherwise, further evaluation is performed. Second, if the webpage cannot be identified as legal, then the webpage is further examined to determine whether it is a phishing page based on the heuristic rules defined by the character features. The first two steps can quickly filter webpages to meet the needs of real-time detection. Finally, a logistic regression classifier is used to assess the remaining pages to enhance the adaptability and accuracy of the detection method. The experimental results show that the SHLR can filter 61.9% of legitimate webpages and identify 22.9% of phishing webpages based on uniform/universal resource locator (URL) lexical information. The accuracy of the SHLR is 98.9%; thus, its phishing detection performance is high.