Needle in a Haystack: Tracking Down Elite Phishing Domains in the Wild
Needle in a Haystack: Tracking Down Elite Phishing Domains in the Wild
复制标题
DOI：
10.1145/3278532.3278569
复制
发表时间：
2018-10
期刊：
影响因子：
--
通讯作者：
K. Tian;Steve T. K. Jan;Hang Hu;D. Yao;G. Wang
中科院分区：
文献类型：
--
作者：
K. Tian;Steve T. K. Jan;Hang Hu;D. Yao;G. Wang
如今的钓鱼网站在不断演变，以欺骗用户并逃避检测。在本文中，我们对仿冒钓鱼域名进行了一项测量研究，这些网站不仅在页面内容层面，而且在网络域名层面都假冒受信任的实体。为了搜索仿冒钓鱼页面，我们在超过2.24亿条DNS记录中扫描了五类仿冒域名，并确定了65.7万个可能假冒702个流行品牌的域名。然后，我们构建了一种新颖的机器学习分类器，用于从仿冒域名下的网页和移动页面中检测钓鱼页面。一个关键的创新点在于，我们的分类器是基于对钓鱼页面在实际中的规避行为的仔细测量而构建的。我们引入了来自视觉分析和光学字符识别（OCR）的新特征，以克服攻击者对内容的严重混淆。我们总共发现并验证了1175个仿冒钓鱼页面。我们表明，这些钓鱼页面被用于各种有针对性的诈骗，并且在逃避检测方面非常有效。其中超过90%的页面至少在一个月内成功避开了流行的黑名单。
Today's phishing websites are constantly evolving to deceive users and evade the detection. In this paper, we perform a measurement study on squatting phishing domains where the websites impersonate trusted entities not only at the page content level but also at the web domain level. To search for squatting phishing pages, we scanned five types of squatting domains over 224 million DNS records and identified 657K domains that are likely impersonating 702 popular brands. Then we build a novel machine learning classifier to detect phishing pages from both the web and mobile pages under the squatting domains. A key novelty is that our classifier is built on a careful measurement of evasive behaviors of phishing pages in practice. We introduce new features from visual analysis and optical character recognition (OCR) to overcome the heavy content obfuscation from attackers. In total, we discovered and verified 1,175 squatting phishing pages. We show that these phishing pages are used for various targeted scams, and are highly effective to evade detection. More than 90% of them successfully evaded popular blacklists for at least a month.