Table of Contents Author Guidelines Submit a Manuscript
Security and Communication Networks
Volume 2017, Article ID 5421046, 20 pages
https://doi.org/10.1155/2017/5421046
Review Article

Phishing Detection: Analysis of Visual Similarity Based Approaches

National Institute of Technology, Kurukshetra, India

Correspondence should be addressed to B. B. Gupta; moc.liamg@jirb.atpug

Received 4 July 2016; Accepted 28 August 2016; Published 10 January 2017

Academic Editor: Muhammad Khurram Khan

Copyright © 2017 Ankit Kumar Jain and B. B. Gupta. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Linked References

  1. M. Khonji, Y. Iraqi, and A. Jones, “Phishing detection: a literature survey,” IEEE Communications Surveys & Tutorials, vol. 15, no. 4, pp. 2091–2121, 2013. View at Publisher · View at Google Scholar · View at Scopus
  2. R. Islam and J. Abawajy, “A multi-tier phishing detection and filtering approach,” Journal of Network and Computer Applications, vol. 36, no. 1, pp. 324–335, 2013. View at Publisher · View at Google Scholar · View at Scopus
  3. A. K. Jain and B. B. Gupta, “Comparative analysis of features based machine learning approaches for phishing detection,” in Proceedings of the 10th INDIA-COM, New Delhi, India, 2016.
  4. G. Weaver, A. Furr, and R. Norton, Deception of Phishing: Studying the Techniques of Social Engineering by Analyzing Modern-Day Phishing Attacks on Universities, 2016.
  5. Kaspersky Lab, “Spam in January 2012 love, politics and sport,” 2013, http://www.kaspersky.com/about/news/spam/2012/Spam_in_January_2012_Love_Politics_and_Sport.
  6. APWG Q1-Q3 Report, 2015, http://docs.apwg.org/reports/apwg_trends_report_q1-q3_2015.pdf.
  7. B. Parmar, “Protecting against spear-phishing,” Computer Fraud & Security, vol. 2012, no. 1, pp. 8–11, 2012. View at Publisher · View at Google Scholar · View at Scopus
  8. W. Jingguo, T. Herath, C. Rui, A. Vishwanath, and H. R. Rao, “Phishing susceptibility: an investigation into the processing of a targeted spear phishing e-mail,” IEEE Transactions on Professional Communication, vol. 55, no. 4, pp. 345–362, 2012. View at Google Scholar
  9. T. N. Jagatic, N. A. Johnson, M. Jakobsson, and F. Menczer, “Social phishing,” Communications of the ACM, vol. 50, no. 10, pp. 94–100, 2007. View at Publisher · View at Google Scholar · View at Scopus
  10. C. H. Hsu, P. Wang, and S. Pu, “Identify fixed-path phishing attack by STC,” in Proceedings of the 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference (CEAS '11), pp. 172–175, ACM, Perth, Australia, September 2011. View at Publisher · View at Google Scholar
  11. N. A. G. Arachchilage and M. Cole, “Designing a mobile game for home computer users to protect against phishing attacks,” https://arxiv.org/abs/1602.03929.
  12. R. Dhamija and J. D. Tygar, “The battle against phishing: Dynamic security skins,” in Proceedings of the Symposium on Usable Privacy and Security (SOUPS '05), pp. 77–88, July 2005. View at Publisher · View at Google Scholar · View at Scopus
  13. S. Sheng, B. Magnien, P. Kumaraguru et al., “Anti-Phishing Phil: the design and evaluation of a game that teaches people not to fall for phish,” in Proceedings of the 3rd Symposium on Usable Privacy and Security (SOUPS '07), Pittsburgh, Pa, USA, July 2007. View at Publisher · View at Google Scholar
  14. K.-P. Yee and K. Sitaker, “Passpet: convenient password management and phishing protection,” in Proceedings of the 2nd Symposium on Usable Privacy and Security (SOUPS '06), pp. 32–43, ACM, Pittsburgh, Pa, USA, July 2006. View at Publisher · View at Google Scholar · View at Scopus
  15. C. Jackson, D. R. Simon, D. S. Tan, and A. Barth, “An evaluation of extended validation and picture-in-picture phishing attacks,” in Proceedings of the 11th International Conference on Financial Cryptography and 1st International Conference on Usable Security (FC '07/USEC '07), pp. 281–293, Springer, Scarborough, UK, February 2007.
  16. M. Jakobsson, “Modeling and preventing phishing attacks,” in Proceedings of the 9th International Conference on Financial Cryptography and Data Security, Roseau, Dominica, February-March 2005.
  17. T. Moore and R. Clayton, “Examining the impact of website take-down on phishing,” in Proceedings of the Anti-Phishing Working Groups 2nd Annual Ecrime Researchers Summit, pp. 1–13, Pittsburgh, Pa, USA, October 2007.
  18. L. James, Phishing Exposed, Syngress Publishing, 2005.
  19. L. H. Lee, K. Lee, Y. Juan, H. Chen, and Y. Tseng, “Users' behavioral prediction for phishing detection,” in Proceedings of the the 23rd International World Wide Web Conference, pp. 337–338, Seoul, Republic of Korea, April 2014. View at Publisher · View at Google Scholar
  20. X. Chen, I. Bose, A. C. M. Leung, and C. Guo, “Assessing the severity of phishing attacks: a hybrid data mining approach,” Decision Support Systems, vol. 50, no. 4, pp. 662–672, 2011. View at Publisher · View at Google Scholar · View at Scopus
  21. M. Moghimi and A. Y. Varjani, “New rule-based phishing detection method,” Expert Systems with Applications, vol. 53, pp. 231–242, 2016. View at Publisher · View at Google Scholar · View at Scopus
  22. G. Ramesh, I. Krishnamurthi, and K. S. S. Kumar, “An efficacious method for detecting phishing webpages through target domain identification,” Decision Support Systems, vol. 61, no. 1, pp. 12–22, 2014. View at Publisher · View at Google Scholar · View at Scopus
  23. P. Beatty, I. Reay, S. Dick, and J. Miller, “Consumer trust in e-commerce web sites: a meta-study,” ACM Computing Surveys, vol. 43, no. 3, article 14, 46 pages, 2011. View at Publisher · View at Google Scholar · View at Scopus
  24. J. M. Pavía, E. J. Veres-Ferrer, and G. Foix-Escura, “Credit card incidents and control systems,” International Journal of Information Management, vol. 32, no. 6, pp. 501–503, 2012. View at Publisher · View at Google Scholar · View at Scopus
  25. S. Bhattacharyya, S. Jha, K. Tharakunnel, and J. Christopher Westland, “Data mining for credit card fraud: a comparative study,” Decision Support Systems, vol. 50, no. 3, pp. 602–613, 2011. View at Google Scholar
  26. M. T. Banday and J. A. Qadri, “Phishing—a growing threat to E-commerce,” The Business Review, vol. 12, no. 2, pp. 76–83, 2007. View at Google Scholar
  27. J. Efrim Boritz and W. G. No, “E-commerce and privacy: Exploring what we know and opportunities for future discovery,” Journal of Information Systems, vol. 25, no. 2, pp. 11–45, 2011. View at Publisher · View at Google Scholar · View at Scopus
  28. Y. Zhang, X. Deng, D. Wei, and Y. Deng, “Assessment of E-Commerce security using AHP and evidential reasoning,” Expert Systems with Applications, vol. 39, no. 3, pp. 3611–3623, 2012. View at Publisher · View at Google Scholar · View at Scopus
  29. M. Aburrous, M. A. Hossain, K. Dahal, and F. Thabtah, “Intelligent phishing detection system for e-banking using fuzzy data mining,” Expert Systems with Applications, vol. 37, no. 12, pp. 7913–7921, 2010. View at Publisher · View at Google Scholar · View at Scopus
  30. M. Aburrous, M. A. Hossain, K. Dahal, and F. Thabtah, “Associative classification techniques for predicting e-banking phishing websites,” in Proceedings of the International Conference on Multimedia Computing and Information Technology (MCIT '10), pp. 9–12, IEEE, Sharjah, UAE, March 2010. View at Publisher · View at Google Scholar · View at Scopus
  31. M. Aburrous, M. A. Hossain, K. Dahal, and F. Thabtah, “Experimental case studies for investigating E-banking phishing techniques and attack strategies,” Cognitive Computation, vol. 2, no. 3, pp. 242–253, 2010. View at Publisher · View at Google Scholar · View at Scopus
  32. W. Kim, O.-R. Jeong, C. Kim, and J. So, “The dark side of the internet: attacks, costs and responses,” Information Systems, vol. 36, no. 3, pp. 675–705, 2011. View at Publisher · View at Google Scholar · View at Scopus
  33. G. Megaw and S. V. Flowerday, “Phishing within e-commerce: a trust and confidence game,” in Proceedings of the Information Security for South Africa (ISSA '10), pp. 1–8, IEEE, Johannesburg, South Africa, August 2010. View at Publisher · View at Google Scholar · View at Scopus
  34. A. Litan, Phishing Attack Victims Likely Targets for Identity Theft, Gartner Group, 2004.
  35. A. Bergholz, J. De Beer, S. Glahn, M.-F. Moens, G. Paaß, and S. Strobel, “New filtering approaches for phishing email,” Journal of Computer Security, vol. 18, no. 1, pp. 7–35, 2010. View at Publisher · View at Google Scholar · View at Scopus
  36. J. Hong, “The state of phishing attacks,” Communications of the ACM, vol. 55, no. 1, pp. 74–81, 2012. View at Publisher · View at Google Scholar · View at Scopus
  37. M. Jakobsson and S. Myers, Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft, Wiley-Interscience, 2006.
  38. Internet world stats—usage and population statistics, 2014, http://www.internetworldstats.com/stats.htm.
  39. RSA Anti-Fraud Command Center, RSA monthly online fraud report, https://www.emc.com/collateral/fraud-report/rsa-online-fraud-report-012014.pdf.
  40. Anti-Phishing Working Group (APWG), Phishing activity trends report first quarter 2014, http://docs.apwg.org/reports/apwg_trends_report_q1_2014.pdf.
  41. APWG report, http://apwg.org/download/document/245/APWG_Global_Phishing_Report_2H_2014.pdf.
  42. RSA Current State of Cybercrime, https://www.rsa.com/en-us/perspectives/industry/online-fraud.
  43. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna, “Automating mimicry attacks using static binary analysis,” in Proceedings of the USENIX Security Symposium, pp. 161–176, Baltimore, Md, USA, 2005.
  44. A. Almomani, B. B. Gupta, S. Atawneh, A. Meulenberg, and E. Almomani, “A survey of phishing email filtering techniques,” IEEE Communications Surveys and Tutorials, vol. 15, no. 4, pp. 2070–2090, 2013. View at Publisher · View at Google Scholar · View at Scopus
  45. A. Tewari, A. K. Jain, and B. B. Gupta, “Recent survey of various defense mechanisms against phishing attacks,” Journal of Information Privacy and Security, vol. 12, no. 1, pp. 3–13, 2016. View at Publisher · View at Google Scholar
  46. B. B. Gupta, A. Tewari, A. K. Jain, and D. P. Agrawal, “Fighting against phishing attacks: state of the art and future challenges,” Neural Computing and Applications, 2016. View at Publisher · View at Google Scholar
  47. R. Dhamija, J. D. Tygar, and M. A. Hearst, “Why phishing works,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI '06), pp. 581–590, ACM Press, 2006. View at Publisher · View at Google Scholar
  48. A. P. E. Rosiello, E. Kirda, C. Kruegel, and F. Ferrandi, “A layout-similarity-based approach for detecting phishing pages,” in Proceedings of the 3rd International Conference on Security and Privacy in Communications Networks and the Workshops (SecureComm '07), pp. 454–463, September 2007. View at Publisher · View at Google Scholar
  49. A. K. Jain and B. B. Gupta, “PHISH-SAFE URL: features based phishing detection system using machine learning,” in Proceedings of the Golden Jubilee Year of the Computer Society of India (CSI '15), New Delhi, India, December 2015.
  50. V. Ramanathan and H. Wechsler, “PhishGILLNET-phishing detection methodology using probabilistic latent semantic analysis, AdaBoost, and co-training,” Eurasip Journal on Information Security, vol. 2012, article 1, 2012. View at Publisher · View at Google Scholar · View at Scopus
  51. S. Sheng, B. Wardman, G. Warner, L. Cranor, J. Hong, and C. Zhang, “An empirical analysis of phishing black-lists,” in Proceedings of the 6th Conference on E-Mail and Anti-Spam (CEAS '09), 2009.
  52. P. Prakash, M. Kumar, R. Rao, and M. Gupta, “Phishnet predictive black-listing to detect phishing attacks,” in Proceedings of the 29th Conference on Information Communications, pp. 346–350, San Diego, Calif, USA, 2010.
  53. A. K. Jain and B. B. Gupta, “A novel approach to protect against phishing attacks at client side using auto-updated white-list,” EURASIP Journal on Information Security, vol. 2016, article 9, 11 pages, 2016. View at Publisher · View at Google Scholar
  54. G. A. Montazer and S. Yarmohammadi, “Detection of phishing attacks in Iranian e-banking using a fuzzy-rough hybrid system,” Applied Soft Computing, vol. 35, pp. 482–492, 2015. View at Publisher · View at Google Scholar
  55. B. Gu, V. S. Sheng, Z. Wang, D. Ho, S. Osman, and S. Li, “Incremental learning for ν-Support Vector Regression,” Neural Networks, vol. 67, pp. 140–150, 2015. View at Publisher · View at Google Scholar · View at Scopus
  56. B. B. Gupta, D. P. Agrawal, and S. Yamaguchi, Handbook of Research on Modern Cryptographic Solutions for Computer and Cyber Security, IGI Global, Hershey, Pa, USA, 2016.
  57. B. Gu, V. S. Sheng, K. Y. Tay, W. Romano, and S. Li, “Incremental support vector learning for ordinal regression,” IEEE Transactions on Neural Networks and Learning Systems, vol. 26, no. 7, pp. 1403–1416, 2015. View at Publisher · View at Google Scholar · View at MathSciNet · View at Scopus
  58. S. Abu-Nimeh, D. Nappa, X. Wang, and S. Nair, “A comparison of machine learning techniques for phishing detection,” in Proceedings of the 2nd Annual eCrime Researchers Summit (eCrime '07), pp. 60–69, ACM, Pittsburgh, Pa, USA, 2007.
  59. A. ALmomani, B. B. Gupta, T.-C. Wan, A. Altaher, and S. Manickam, “Phishing dynamic evolving neural fuzzy framework for online detection ‘zero-day’ phishing E-mail,” Indian Journal of Science and Technology, vol. 6, no. 1, pp. 3960–3964, 2013. View at Google Scholar · View at Scopus
  60. R. M. Basnet, S. Mukkamala, and A. H. Sung, “Detection of phishing attacks: a machine learning approach,” Studies in Fuzziness and Soft Computing, vol. 226, pp. 373–383, 2008. View at Publisher · View at Google Scholar · View at Scopus
  61. W. Han, Y. Cao, E. Bertino, and J. Yong, “Using automated individual white-list to protect web digital identities,” Expert Systems with Applications, vol. 39, no. 15, pp. 11861–11869, 2012. View at Publisher · View at Google Scholar · View at Scopus
  62. Y. Cao, W. Han, and Y. Le, “Anti-phishing based on automated individual white-list,” in Proceedings of the 4th ACM Workshop on Digital Identity Management (DIM '08), pp. 51–60, ACM, 2008. View at Publisher · View at Google Scholar
  63. Y. Zhang, J. I. Hong, and L. F. Cranor, “Cantina: a content-based approach to detecting phishing web sites,” in Proceedings of the 16th International World Wide Web Conference (WWW '07), pp. 639–648, Banff, Canda, May 2007. View at Publisher · View at Google Scholar · View at Scopus
  64. G. Xiang, J. Hong, C. P. Rose, and L. Cranor, “CANTINA+: a feature-rich machine learning framework for detecting phishing web sites,” ACM Transactions on Information and System Security, vol. 14, no. 2, article 21, 2011. View at Publisher · View at Google Scholar
  65. F. Harary, Graph Theory, Addison-Wesley, 1969. View at MathSciNet
  66. W. Liu, X. Deng, G. Huang, and A. Y. Fu, “An antiphishing strategy based on visual similarity assessment,” IEEE Internet Computing, vol. 10, no. 2, pp. 58–65, 2006. View at Publisher · View at Google Scholar · View at Scopus
  67. C.-Y. Huang, S.-P. Ma, W.-L. Yeh, C.-Y. Lin, and C.-T. Liu, “Mitigate web phishing using site signatures,” in Proceedings of the IEEE Region 10 Conference TENCON, pp. 803–808, November 2010. View at Publisher · View at Google Scholar
  68. S. Afroz and R. Greenstadt, “PhishZoo: detecting phishing websites by looking at them,” in Proceedings of the 5th Annual IEEE International Conference on Semantic Computing (ICSC '11), pp. 368–375, Palo Alto, Calif, USA, September 2011. View at Publisher · View at Google Scholar · View at Scopus
  69. A. Mishra and B. B. Gupta, “Hybrid solution to detect and filter zero-day phishing attacks,” in Proceedings of the Emerging Research in Computing, Information, Communication and Applications (ERCICA '14), Bangalore, India, August 2014.
  70. M. Hara, A. Yamada, and Y. Miyake, “Visual similarity-based phishing detection without victim site information,” in Proceedings of the IEEE Symposium on Computational Intelligence in Cyber Security (CICS '09), pp. 30–36, IEEE, Nashville, Tenn, USA, April 2009. View at Publisher · View at Google Scholar · View at Scopus
  71. J. Mao, P. Li, K. Li, T. Wei, and Z. Liang, “BaitAlarm: detecting phishing sites using similarity in fundamental visual features,” in Proceedings of the 5th IEEE International Conference on Intelligent Networking and Collaborative Systems (INCoS '13), pp. 790–795, Xi’an, China, September 2013. View at Publisher · View at Google Scholar · View at Scopus
  72. K.-T. Chen, J.-Y. Chen, C.-R. Huang, and C.-S. Chen, “Fighting phishing with discriminative keypoint features,” IEEE Internet Computing, vol. 13, no. 3, pp. 56–63, 2009. View at Publisher · View at Google Scholar · View at Scopus
  73. M. Dunlop, S. Groat, and D. Shelly, “GoldPhish: using images for content-based phishing analysis,” in Proceedings of the 5th International Conference on Internet Monitoring and Protection (ICIMP '10), pp. 123–128, Barcelona, Spain, May 2010. View at Publisher · View at Google Scholar · View at Scopus
  74. A. P. Singh, V. Kumar, S. Sengar, and M. Wairiya, “Detection and prevention of phishing attack using dynamic watermarking,” in Information Technology and Mobile Communication, Communications in Computer and Information Science, pp. 132–137, Springer, 2011. View at Google Scholar
  75. I.-F. Lam, W.-C. Xiao, S.-C. Wang, and K.-T. Chen, “Counteracting phishing page polymorphism: an image layout analysis approach,” in Proceedings of the 3rd International Conference and Workshops on Advances in Information Security and Assurance, pp. 270–279, Seoul, Republic of Korea, 2009.
  76. N. Otsu, “A threshold selection method from gray-level histograms,” IEEE Transactions on Systems Man and Cybernetics, vol. 9, no. 1, pp. 62–66, 1979. View at Publisher · View at Google Scholar
  77. A. Y. Fu, W. Liu, and X. Deng, “Detecting phishing web pages with visual similarity assessment based on Earth Mover's Distance (EMD),” IEEE Transactions on Dependable and Secure Computing, vol. 3, no. 4, pp. 301–311, 2006. View at Publisher · View at Google Scholar · View at Scopus
  78. C. Jacobs, A. Finkelstein, and D. Salesin, “Fast multi resolution image querying,” in Proceedings of the 22nd Annual Conference on Computer Graphics and Interactive Techniques (SIGGRAPH '95), pp. 277–286, Los Angeles, Calif, USA, August 1995.
  79. H. Zhang, G. Liu, T. W. S. Chow, and W. Liu, “Textual and visual content-based anti-phishing: a Bayesian approach,” IEEE Transactions on Neural Networks, vol. 22, no. 10, pp. 1532–1546, 2011. View at Publisher · View at Google Scholar · View at Scopus
  80. M. Ertheimer, Gestalt Theory, Hayes Barton Press, New York, NY, USA, 1944.
  81. E. Medvet, E. Kirda, and C. Kruegel, “Visual-similarity-based phishing detection,” in Proceedings of the 4th International Conference on Security and Privacy in Communication Networks (SecureComm '08), 245, p. 234, İstanbul, Turkey, September 2008. View at Publisher · View at Google Scholar · View at Scopus
  82. G. Liu, B. Qiu, and L. Wenyin, “Automatic detection of phishing target from phishing webpage,” in Proceedings of the 20th International Conference on Pattern Recognition (ICPR '10), pp. 4153–4156, Istanbul, Turkey, 2010.
  83. K. L. Chiew, E. H. Chang, S. N. Sze, and W. K. Tiong, “Utilisation of website logo for phishing detection,” Computers & Security, vol. 54, pp. 16–26, 2015. View at Publisher · View at Google Scholar · View at Scopus
  84. T.-C. Chen, S. Dick, and J. Miller, “Detecting visually similar web pages: application to phishing detection,” ACM Transactions on Internet Technology, vol. 10, no. 2, article 5, 38 pages, 2010. View at Publisher · View at Google Scholar · View at Scopus
  85. C.-R. Huang, C.-S. Chen, and P.-C. Chung, “Contrast context histogram—an efficient discriminating local descriptor for object recognition and image matching,” Pattern Recognition, vol. 41, no. 10, pp. 3071–3077, 2008. View at Publisher · View at Google Scholar · View at Scopus
  86. P. A. Barraclough, M. A. Hossain, M. A. Tahir, G. Sexton, and N. Aslam, “Intelligent phishing detection and protection scheme for online transactions,” Expert Systems with Applications, vol. 40, no. 11, pp. 4697–4706, 2013. View at Publisher · View at Google Scholar · View at Scopus
  87. K. Parsons, A. McCormac, M. Pattinson, M. Butavicius, and C. Jerram, “The design of phishing studies: challenges for researchers,” Computers & Security, vol. 52, pp. 194–206, 2015. View at Publisher · View at Google Scholar · View at Scopus