Combating real phishing

: target detection and applications

Abstract

Phishing is an internet security problem emerged in the beginning of modern Internet (1995). It steals billions of dollars each year world-widely and hence become a serious security concern. Among three major stances toward phishing threats, we exemplify that law enforcement and user education approaches are unattainable, technical intervention hence becomes the primary countermeasure. We deduced a common assumption, unilateral authentication model (UAM), for all kind of technical responses. We argue that UAM is the root cause of phishing vulnerability and it is intractable for traditional distributed computing systems. Thus, automatically phishing detection models are in strong demand. As part of the technical responses, we developed an automatic phishing detection model, the parasitic community, based on the heuristics of link topology. Experiments show that the result is highly competitive in terms of high accuracy and low false alarm. Moreover, we argue that phishing problem is hard to cope because it requires global cooperation. i.e. an elegant phishing detection model is useful only if it gets widely available. In the light of the divide and conquer ideology, and to bring phishing problem from global to local (company-wide), we pioneered the attempt and developed a method to identify phishing target automatically. Specifically, we identify the exact phishing target of a given phishing page by measuring the hellinger distance over the latent topic distribution. Experiments shows a promising result with sufficient accuracy (over 90%) and time efficiency (within a few seconds).

Date of Award	3 Oct 2014
Original language	English
Awarding Institution	City University of Hong Kong
Supervisor	Wenyin LIU (Supervisor) & Qing LI (Supervisor)