HinPhish: An Effective Phishing Detection Approach Based on Heterogeneous Information Networks
Source abstract
Abstract
Internet users have suffered from phishing attacks for a long time. Attackers deceive users through malicious constructed phishing websites to steal sensitive information, such as bank account numbers, website usernames, and passwords. In recent years, many phishing detection solutions have been proposed, which mainly leverage whitelists or blacklists, website content, or side channel-based techniques. However, with the continuous improvement of phishing technology, current methods have difficulty in achieving effective detection. Hence, in this paper, we propose an effective phishing website detection approach, which we call HinPhish. HinPhish extracts various link relationships from webpages and uses domains and resource objects to construct a heterogeneous information network. HinPhish applies a modified algorithm to leverage the characteristics of different link types in order to calculate the phish-score of the target domain on the webpage. Moreover, HinPhish not only improves the accuracy of detection, but also can increase the phishing cost for attackers. Extensive experimental results demonstrate that HinPhish can achieve an accuracy of 0.9856 and F1-score of 0.9858.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Spam and Phishing Detection · Internet Traffic Analysis and Secure E-voting · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei 230037, China
References (47)
Show source-provided references
1. Oest, A., Safei, Y., Doupé, A., Ahn, G.J., Wardman, B., and Warner, G. (2018, January 15–17). Inside a phisher’s mind: Understanding the anti-phishing ecosystem through phishing kit analysis. Proceedings of the 2018 APWG Symposium on Electronic Crime Research (eCrime), San Diego, CA, USA.10.1109/ECRIME.2018.8376206 ↗
2. APWG (2021, August 11). Phishing Activity Trends Report. Available online: https://docs.apwg.org/reports/apwg_trends_report_q1_2021.pdf.
3. Invernizzi, L., Thomas, K., Kapravelos, A., Comanescu, O., Picod, J.M., and Bursztein, E. (2016, January 22–26). Cloak of visibility: Detecting when machines browse a different web. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.10.1109/SP.2016.50 ↗
4. Zhang, P., Oest, A., Cho, H., Sun, Z., Johnson, R., Wardman, B., Sarker, S., Kapravelos, A., Bao, T., and Wang, R. (2021, January 23–27). CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP40001.2021.00021 ↗
5. LogoSENSE: A companion HOG based logo detection scheme for phishing web page and E-mail brand recognition10.1016/j.cose.2020.101855 ↗
6. Alabdan, R. (2020). Phishing Attacks Survey: Types, Vectors, and Technical Approaches. Future Internet, 12.10.3390/fi12100168 ↗
7. Sun, Y., Han, J., Zhao, P., Yin, Z., Cheng, H., and Wu, T. (2009, January 24–26). Rankclus: Integrating clustering with ranking for heterogeneous information network analysis. Proceedings of the 12th International Conference on Extending Database Technology: Advances in Database Technology, Saint Petersburg, Russia.10.1145/1516360.1516426 ↗
8. Cao, Y., Han, W., and Le, Y. (2008, January 31). Anti-Phishing Based on Automated Individual White-List. Proceedings of the 4th ACM Workshop on Digital Identity Management, Alexandria, WV, USA.10.1145/1456424.1456434 ↗
9. Rosiello, A.P., Kirda, E., and Ferrandi, F. (2007, January 17–21). A layout-similarity-based approach for detecting phishing pages. Proceedings of the 2007 Third International Conference on Security and Privacy in Communications Networks and the Workshops-SecureComm 2007, Nice, France.10.1109/SECCOM.2007.4550367 ↗
10. Prakash, P., Kumar, M., Kompella, R.R., and Gupta, M. (2010, January 14–19). Phishnet: Predictive blacklisting to detect phishing attacks. Proceedings of the 2010 Proceedings IEEE INFOCOM, San Diego, CA, USA.10.1109/INFCOM.2010.5462216 ↗
11. Rao, R.S., and Pais, A.R. (2017). An enhanced blacklist method to detect phishing websites. Lecture Notes in Computer Science, Proceedings of the International Conference on Information Systems Security, Mumbai, India, 16–20 December 2017, Springer.10.1007/978-3-319-72598-7_20 ↗
12. Eshete, B. (2013, January 13–17). Effective analysis, characterization, and detection of malicious web pages. Proceedings of the 22nd International Conference on World Wide Web, Rio de Janeiro, Brazil.10.1145/2487788.2487942 ↗
13. Nguyen, L.A.T., To, B.L., Nguyen, H.K., and Nguyen, M.H. (2014, January 27–29). A novel approach for phishing detection using URL-based heuristic. Proceedings of the 2014 International Conference on Computing, Management and Telecommunications (ComManTel), Da Nang, Vietnam.
14. Zhuang, W., Jiang, Q., and Xiong, T. (2012, January 18–21). An intelligent anti-phishing strategy model for phishing website detection. Proceedings of the 2012 32nd International Conference on Distributed Computing Systems Workshops, Macau, China.10.1109/ICDCSW.2012.66 ↗
15. Intelligent web-phishing detection and protection scheme using integrated features of Images, frames and text10.1016/j.eswa.2018.07.067 ↗
16. Two-stage ELM for phishing Web pages detection using hybrid features10.1007/s11280-016-0418-9 ↗
17. A stacking model using URL and HTML features for phishing webpage detection10.1016/j.future.2018.11.004 ↗
18. Shirazi, H., Bezawada, B., and Ray, I. (2018, January 13–15). “Kn0w Thy Doma1n Name” Unbiased Phishing Detection Using Domain Name Based Features. Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies, Indianapolis, IN, USA.10.1145/3205977.3205992 ↗
19. Aljofey, A., Jiang, Q., Qu, Q., Huang, M., and Niyigena, J.P. (2020). An Effective Phishing Detection Model Based on Character Level Convolutional Neural Network from URL. Electronics, 9.10.3390/electronics9091514 ↗
20. Marchal, S., Saari, K., Singh, N., and Asokan, N. (2016, January 27–30). Know your phish: Novel techniques for detecting phishing sites and their targets. Proceedings of the 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), Nara, Japan.10.1109/ICDCS.2016.10 ↗
21. Utilisation of website logo for phishing detection10.1016/j.cose.2015.07.006 ↗
22. Leverage website favicon to detect phishing websites10.1155/2018/7251750 ↗
23. Alwaghid, A.F., and Sarkar, N.I. (2020). Exploring Malware Behavior of Webpages Using Machine Learning Technique: An Empirical Study. Electronics, 9.10.3390/electronics9061033 ↗
24. Medvet, E., Kirda, E., and Kruegel, C. (2008, January 22–25). Visual-similarity-based phishing detection. Proceedings of the 4th International Conference on Security and Privacy in Communication Netowrks, Istanbul, Turkey.10.1145/1460877.1460905 ↗
25. Lin, Y., Liu, R., Divakaran, D.M., Ng, J.Y., Chan, Q.Z., Lu, Y., Si, Y., Zhang, F., and Dong, J.S. (2021, January 11–13). Phishpedia: A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual, Online.
26. Off-the-hook: An efficient and usable client-side phishing prevention application10.1109/TC.2017.2703808 ↗
27. Detection of phishing websites using an efficient feature-based machine learning framework10.1007/s00521-017-3305-0 ↗
28. Rendall, K., Nisioti, A., and Mylonas, A. (2020). Towards a Multi-Layered Phishing Detection. Sensors, 20.10.3390/s20164540 ↗
29. Intelligent rule-based phishing websites classification10.1049/iet-ifs.2013.0202 ↗
30. The eu general data protection regulation (gdpr)
31. An efficacious method for detecting phishing webpages through target domain identification10.1016/j.dss.2014.01.002 ↗
32. A phish detector using lightweight search features10.1016/j.cose.2016.08.003 ↗
33. Two-level authentication approach to protect from phishing attacks in real time10.1007/s12652-017-0616-z ↗
34. Jail-Phish: An improved search engine based phishing detection system10.1016/j.cose.2019.02.011 ↗
35. Han, J. (2009). Mining heterogeneous information networks by exploring the power of links. Lecture Notes in Computer Science, Proceedings of the International Conference on Discovery Science, Porto, Portugal, 3–5 October 2009, Springer.10.1007/978-3-642-04747-3_2 ↗
36. A survey of heterogeneous information network analysis10.1109/TKDE.2016.2598561 ↗
37. Hou, S., Ye, Y., Song, Y., and Abdulhayoglu, M. (2017, January 13–17). Hindroid: An intelligent android malware detection system based on structured heterogeneous information network. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Halifax, NS, Canada.10.1145/3097983.3098026 ↗
38. Gao, Y., Xiaoyong, L., Hao, P., Fang, B., and Yu, P. (2020). Hincti: A cyber threat intelligence modeling and identification system based on heterogeneous information network. IEEE Trans. Knowl. Data Eng.
39. Sun, X., Tong, M., Yang, J., Xinran, L., and Heng, L. (2019, January 23–25). Hindom: A robust malicious domain detection system based on heterogeneous information network with transductive classification. Proceedings of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses ({RAID} 2019), Beijing, China.
40. Sun, Y., Yu, Y., and Han, J. (July, January 28). Ranking-based clustering of heterogeneous information networks with star network schema. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Paris, France.
41. Mining heterogeneous information networks: A structural analysis approach10.1145/2481244.2481248 ↗
42. A Method based on Modified PageRank-Algorithm for Measuring and Rating Android Malwares10.1016/j.procs.2020.06.081 ↗
43. OpenPhish (2020, October 20). OpenPhish. Available online: https://www.openphish.com/.
44. Alexa (2020, October 21). Alexa Ranking. Available online: https://www.alexa.com/siteinfo.
45. Desai, A., Jatakia, J., Naik, R., and Raul, N. (2017, January 19–20). Malicious web content detection using machine leaning. Proceedings of the 2017 2nd IEEE International Conference on Recent Trends in Electronics, Information & Communication Technology (RTEICT), Bangalore, India.10.1109/RTEICT.2017.8256834 ↗
46. Shahrivari, V., Darabi, M.M., and Izadi, M. (2020). Phishing Detection Using Machine Learning Techniques. arXiv.
47. Yunyi Zhang, S.J. (2021). Hacks Hit the Phish: Phish Attack Detection based on Hacks Search. Lecture Notes in Computer Science, Proceedings of the International Conference on Wireless Algorithms, Systems, and Applications, Nanjing, China, 25–27 June 2021, Springer.10.1007/978-3-030-86137-7_33 ↗