Phishing attacks discovery based on HTML layout similarity

Xue-qiang ZOU; Peng ZHANG; Cai-yun HUANG; Zhi-peng CHEN; Yong SUN; Qing-yun LIU

doi:10.11959/j.issn.1000-436x.2016257

您当前的位置：

首页 >

文章列表页 >

Phishing attacks discovery based on HTML layout similarity

Contents Papers | 更新时间：2024-06-05

- Phishing attacks discovery based on HTML layout similarity
- Journal on Communications Vol. 37, Issue Z1, Pages: 116-124(2016)
- 作者机构：
  
  1. 中国科学院信息工程研究所，北京 100093
  2. 国家计算机网络应急技术处理协调中心，北京 100029
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61402464);The National Natural Science Foundation of China(61402474);The National Natural Science Foundation of China(61602467);The National High Technology Research and Development Program (863 Program)(SS2014AA012303)
- DOI：10.11959/j.issn.1000-436x.2016257
  CLC： TP319
- Online First：2016-10，
  
  Published：25 October 2016
- 稿件说明：
移动端阅览
Xue-qiang ZOU, Peng ZHANG, Cai-yun HUANG, et al. Phishing attacks discovery based on HTML layout similarity[J]. Journal on Communications, 2016, 37(Z1): 116-124.
DOI：

Xue-qiang ZOU, Peng ZHANG, Cai-yun HUANG, et al. Phishing attacks discovery based on HTML layout similarity[J]. Journal on Communications, 2016, 37(Z1): 116-124. DOI： 10.11959/j.issn.1000-436x.2016257.

摘要

针对钓鱼网页与真实网页布局结构相似的特点，提出了基于页面布局相似性的钓鱼网页发现方法，该方法首先抽取出网页中带链接属性的标签作为特征，然后基于该特征提取网页标签序列分支来标识网页；接着通过网页标签序列树对齐算法将网页标签序列树的对齐转换成网页标签序列分支的对齐，使二维的树结构转换成一维的字符串结构，最后通过生物信息学 BLOSUM62编码的替换矩阵快速计算对齐分值，从而提高钓鱼网页的检测效果，仿真实验表明该方法可行，并具有较高的准确率和召回率。

Abstract

Based on the similarity of the layout structure between the phishing sites and real sites

an approach to discover phishing sites was presented.First

the tag with link attribute as a feature was extracted

and then based on the feature

the page tag sequence branch to identify website was extracted

followed by the page layout similarity-HTMLTagAntiPhish

the alignment of page tag sequence tree into the alignment of page tag sequence branches was converted

this converted two-dimention tree structure into one-dimention string structure

and finally through the substitution matrix of bioinfor-matics BLOSUM62 coding

alignment score quickly to improve the phishing sites detection efficiency was computed.A series of simulation experiments show that this approach is feasible and has higher precision and recall rates.

关键词

Keywords

references

LI Z , ALRWAIS S , XIE Y , et al . Finding the linchpins of the dark Web:a study on topologically dedicated hosts on malicious web infrastruc-tures[C]//IEEE Symposium on Security and Privacy (SP) . 2013 : 112 - 126 .

CANALI D , COVA M , VIGNA G , et al . Prophiler:a fast filter for the large-scale detection of malicious web pages[C]//The 20th Interna-tional Conference on World Wide Web . 2011 : 197 - 206 .

ESHETE B , VILLAFIORITA A , WELDEMARIAM K . Binspect:holis-tic analysis and detection of malicious web pages [J ] . Security and Pri-vacy in Communication Networks , 2013 , 106 : 149 - 166 .

PRAKASH P , KUMAR M , KOMPELLA R R , et al . Phishnet:predictive blacklisting to detect phishing attacks[C]//The 29th IEEE International Conference on Computer Communications (INFOCOM) . 2010 : 1 - 5 .

SHENG S , WARDMAN B , WARNER G , et al . An empirical analysis of phishing blacklists[C]//The 6th Conference in Email and Anti-Spam (CEAS) . 2009 .

LIU G , QIU B , LIU Y . Automatic detection of phishing target from phishing webpage[C]//The 20th International Conference on Pattern Recognition (ICPR) . 2010 : 4153 - 4156 .

BLOSUM62 substitution matrix [EB/OL ] . http://www.uky.edu/Classes/BIO/520/BIO520WWW/blosum62.htm http://www.uky.edu/Classes/BIO/520/BIO520WWW/blosum62.htm .

OpenDNS PhishTank [EB/OL ] . http://www.phishtank.com http://www.phishtank.com . 2014 .

URoulette.Home Page [EB/OL ] . http://www.uroulette.com http://www.uroulette.com , 2007 .

Views

1507

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

AI问答

⁰