PhishBox: An Approach for Phishing Validation and Detection

• Published in: 2017 IEEE 15th Intl Conf on Dependable, Autonomic and Secure Computing, 15th Intl Conf on Pervasive Intelligence and Computing, 3rd Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress(DASC/PiCom/DataCom/CyberSciTech) pp. 557 - 564
• Main Authors: Li, Jhen-Hao, Wang, Sheng-De
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.11.2017
• Subjects: Active learning; Analytical models; Big Data; Data models; Monitoring; Phishing; Phishing attacks; Phishing detection; Phishing validation; Visualization
• DOI: 10.1109/DASC-PICom-DataCom-CyberSciTec.2017.101

In this paper, we propose an approach, called PhishBox, to effectively collect phishing data and generate models for phishing validation and detection. The proposed approach integrates the phishing websites collection, validation and detection into an on-line tool, which can monitor the blacklist of PhishTank and validate and detect phishing websites in real-time. Due to the short life time of phishing websites, the proposed approach uses a two-stage detection model to ensure the performance. First, we design an ensemble model to validate the phishing data and apply active learning for reducing the cost of manual labeling. The result shows that our ensemble validation model can achieve high performance with 95% accuracy and 3.9% false-positive rate. Next, the validated phishing data will be used to train a detection model. Comparing with the original dataset, the false-positive rate of phishing detection is dropped by 43.7% in average. After participating the voting procedure on PhishTank, the result shows that our two-stage model is effective to verify phishing websites. Finally, we monitor the blacklist and found that the blacklist contains lots of invalid data. According to our experiment, we can remove five times more than regularly update after one week.