Poster: Lightweight Content-based Phishing Detection. Ardi, C. & Heidemann, J. Technical Report ISI-TR-2015-698, USC/Information Sciences Institute, May, 2015. ![Poster: Lightweight Content-based Phishing Detection [link]](https://bibbase.org/img/filetypes/link.svg "link")
Paper abstract bibtex Increasing use of Internet banking and shopping by a broad spectrum of users results in greater potential profits from phishing attacks via websites that masquerade as legitimate sites to trick users into sharing passwords or financial information. Most browsers today detect potential phishing with URL blacklists; while effective at stopping previously known threats, blacklists must react to new threats as they are discovered, leaving users vulnerable for a period of time. Alternatively, whitelists can be used to identify ``known-good'' websites so that off-list sites (to include possible phish) can never be accessed, but are too limited for many users. Our goal is proactive detection of phishing websites with neither the delay of blacklist identification nor the strict constraints of whitelists. Our approach is to list known phishing targets, index the content at their correct sites, and then look for this content to appear at incorrect sites. Our insight is that cryptographic hashing of page contents allows for efficient bulk identification of content reuse at phishing sites. Our contribution is a system to detect phish by comparing hashes of visited websites to the hashes of the original, known good, legitimate website. We implement our approach as a browser extension in Google Chrome and show that our algorithms detect a majority of phish, even with minimal countermeasures to page obfuscation. A small number of alpha users have been using the extension without issues for several weeks, and we will be releasing our extension and source code upon publication.
@TechReport{Ardi15a,
author = "Calvin Ardi and John Heidemann",
title = "Poster: Lightweight Content-based Phishing Detection",
institution = "USC/Information Sciences Institute",
year = 2015,
sortdate = "2015-05-01",
number = "ISI-TR-2015-698",
month = may,
location = "johnh: pafile",
keywords = "hashing, content reuse, wikipedia, copying, phising",
url = "https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.html",
pdfurl = "https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.pdf",
otherurl = "http://www.isi.edu/publications/trpublic/files/tr-698.pdf",
myorganization = "USC/Information Sciences Institute",
copyrightholder = "authors",
project = "ant, retrofuture, mega",
abstract = "
Increasing use of Internet banking and shopping by a broad spectrum of users
results in greater potential profits from phishing attacks via websites that
masquerade as legitimate sites to trick users into sharing passwords or
financial information. Most browsers today detect potential phishing with URL
blacklists; while effective at stopping previously known threats, blacklists
must react to new threats as they are discovered, leaving users vulnerable for
a period of time. Alternatively, whitelists can be used to identify
``known-good'' websites so that off-list sites (to include possible phish) can
never be accessed, but are too limited for many users. Our goal is proactive
detection of phishing websites with neither the delay of blacklist
identification nor the strict constraints of whitelists. Our approach is to
list known phishing targets, index the content at their correct sites, and then
look for this content to appear at incorrect sites. Our insight is that
cryptographic hashing of page contents allows for efficient bulk identification
of content reuse at phishing sites. Our contribution is a system to detect
phish by comparing hashes of visited websites to the hashes of the original,
known good, legitimate website. We implement our approach as a browser
extension in Google Chrome and show that our algorithms detect a majority of
phish, even with minimal countermeasures to page obfuscation. A small number of
alpha users have been using the extension without issues for several weeks, and
we will be releasing our extension and source code upon publication.",
}
Downloads: 0
{"_id":"TXYE6Cv7wqKQrG6Wt","bibbaseid":"ardi-heidemann-posterlightweightcontentbasedphishingdetection-2015","author_short":["Ardi, C.","Heidemann, J."],"bibdata":{"bibtype":"techreport","type":"techreport","author":[{"firstnames":["Calvin"],"propositions":[],"lastnames":["Ardi"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]}],"title":"Poster: Lightweight Content-based Phishing Detection","institution":"USC/Information Sciences Institute","year":"2015","sortdate":"2015-05-01","number":"ISI-TR-2015-698","month":"May","location":"johnh: pafile","keywords":"hashing, content reuse, wikipedia, copying, phising","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.pdf","otherurl":"http://www.isi.edu/publications/trpublic/files/tr-698.pdf","myorganization":"USC/Information Sciences Institute","copyrightholder":"authors","project":"ant, retrofuture, mega","abstract":"Increasing use of Internet banking and shopping by a broad spectrum of users results in greater potential profits from phishing attacks via websites that masquerade as legitimate sites to trick users into sharing passwords or financial information. Most browsers today detect potential phishing with URL blacklists; while effective at stopping previously known threats, blacklists must react to new threats as they are discovered, leaving users vulnerable for a period of time. Alternatively, whitelists can be used to identify ``known-good'' websites so that off-list sites (to include possible phish) can never be accessed, but are too limited for many users. Our goal is proactive detection of phishing websites with neither the delay of blacklist identification nor the strict constraints of whitelists. Our approach is to list known phishing targets, index the content at their correct sites, and then look for this content to appear at incorrect sites. Our insight is that cryptographic hashing of page contents allows for efficient bulk identification of content reuse at phishing sites. Our contribution is a system to detect phish by comparing hashes of visited websites to the hashes of the original, known good, legitimate website. We implement our approach as a browser extension in Google Chrome and show that our algorithms detect a majority of phish, even with minimal countermeasures to page obfuscation. A small number of alpha users have been using the extension without issues for several weeks, and we will be releasing our extension and source code upon publication.","bibtex":"@TechReport{Ardi15a,\n\tauthor = \"Calvin Ardi and John Heidemann\",\n\ttitle = \"Poster: Lightweight Content-based Phishing Detection\",\n\tinstitution = \"USC/Information Sciences Institute\",\n\tyear = 2015,\n\tsortdate = \"2015-05-01\",\n\tnumber = \"ISI-TR-2015-698\",\n\tmonth = may,\n\tlocation = \"johnh: pafile\",\n\tkeywords = \"hashing, content reuse, wikipedia, copying, phising\",\n\turl = \"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.html\",\n\tpdfurl = \"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.pdf\",\n\totherurl = \"http://www.isi.edu/publications/trpublic/files/tr-698.pdf\",\n\tmyorganization = \"USC/Information Sciences Institute\",\n\tcopyrightholder = \"authors\",\n\tproject = \"ant, retrofuture, mega\",\n\tabstract = \"\nIncreasing use of Internet banking and shopping by a broad spectrum of users\nresults in greater potential profits from phishing attacks via websites that\nmasquerade as legitimate sites to trick users into sharing passwords or\nfinancial information. Most browsers today detect potential phishing with URL\nblacklists; while effective at stopping previously known threats, blacklists\nmust react to new threats as they are discovered, leaving users vulnerable for\na period of time. Alternatively, whitelists can be used to identify\n``known-good'' websites so that off-list sites (to include possible phish) can\nnever be accessed, but are too limited for many users. Our goal is proactive\ndetection of phishing websites with neither the delay of blacklist\nidentification nor the strict constraints of whitelists. Our approach is to\nlist known phishing targets, index the content at their correct sites, and then\nlook for this content to appear at incorrect sites. Our insight is that\ncryptographic hashing of page contents allows for efficient bulk identification\nof content reuse at phishing sites. Our contribution is a system to detect\nphish by comparing hashes of visited websites to the hashes of the original,\nknown good, legitimate website. We implement our approach as a browser\nextension in Google Chrome and show that our algorithms detect a majority of\nphish, even with minimal countermeasures to page obfuscation. A small number of\nalpha users have been using the extension without issues for several weeks, and\nwe will be releasing our extension and source code upon publication.\",\n}\n\n","author_short":["Ardi, C.","Heidemann, J."],"bibbaseid":"ardi-heidemann-posterlightweightcontentbasedphishingdetection-2015","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi15a.html"},"keyword":["hashing","content reuse","wikipedia","copying","phising"],"metadata":{"authorlinks":{}}},"bibtype":"techreport","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["hashing","content reuse","wikipedia","copying","phising"],"search_terms":["poster","lightweight","content","based","phishing","detection","ardi","heidemann"],"title":"Poster: Lightweight Content-based Phishing Detection","year":2015}