Uus heuristikal põhinev õngitsemise avastamine Selenium Webdriveriga
Files
Date
2017
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Õngitsemine on oluline probleem, mis hõlmab endas petlike meilide ja veebilehtede kasutamist, tüssates pahaaimamatuid kasutajad vabatahtlikult avaldama konfidentsiaalset informatsiooni. Antud uurimustöö põhifookuseks on avastada õngitsemise veebilehti, mis kasutavad identifitseerimiseks meili ja salasõna, et pääseda ligi personaalsele või piiratud sisule. Töös esitletakse SeleniumPhishGuard-i rakenduse kasutusmugavust ning analüüsitakse selle uudse heuristilise lähenemisega programmi võimalusi ja tulemusi õngitsemise lehekülgede tuvastamisel. Esmalt hinnatakse ning diskuteeritakse olemasolevate parimate tehnoloogiliste lahenduste ning meetodite üle, mis kasutavad sarnast heuristikat. Selles magistritöös on kasutatud metoodikat, mis identifitseerib võltsveebilehed, sisestades vormi vigased andmed ning analüüsides saadud vastust. Lisaks serverist saadud andmevahetusele pakume metoodikat, mis määrab veebilehe legitiimsuse teiste põhimõtete järgi. Rakendus on realiseeritud Pythoni programmeerimiskeeles kasutades Selenium veebi testimise raamatukogu. Sellest tulenevalt on ka programmi nimes viidatud Seleniumile. Rakenduse testimiseks on kasutatud Alexa top 500 ja Phistank andmebaase. Kõiki sisselogimise vormiga veebilehti Alexa 500 ja Phistank andmebaasides töödeldi ja analüüsiti kasutades antud rakendust. Rakendus töötab kõikide identifitseerimistehnoloogiatega, mis põhinevad isikuandmete vahendamisel. Praegune prototüüp on välja töötatud lehtedele, mis toetavad nii HTTP kui ka HTTPS audentimist ning aktsepteerivad isikuandmetena meili ja parooli. Algoritm on välja töötatud iseseisva moodulina ning tulevikus on võimalik seda integreerida veebilehitseja lisana läbi API. Lisaks olemasolevale metoodikale on hinnatud ja uuritud erinevate URL analüüside tehnikaid, mida kasutati vale positiivse info vähendamiseks ning soorituse parandamiseks. Katsetused näitasid, et SeleniumPhishGuard rakendus on hiilgav tööriist avastamaks õngitsemise vorme. Rakendus suutis tuvastada ligikaudu 96% sisselogimisega õngitsemislehtedest.
Phishing is a nontrivial problem involving deceptive emails and webpages that trick unsuspecting users into willingly revealing their confidential information. In this paper, we focus on detecting login phishing pages, pages that contain forms with email and password fields to allow for authorization to personal/restricted content. We present the design, implementation,and evaluation of our phishing detection tool “SeleniumPhishGuard”, a novel heuristic-based approach to detect phishing login pages. First, the finest existing technologies or techniques that have used similar heuristics we will be discussed and evaluated. The methodology introduced in our paper identifies fraudulent websites by submitting incorrect credentials and analyzing the response. We have also proposed a mechanism for analyzing the responses from server against the submissions of all those credentials to determine thelegitimacy of a given website. The application was implemented in python programming language by utilizing Selenium web testing library, hence “Selenium” is used in the name of our tool. To test the application, a dataset from Alexa top 500 and Phishtank was collected.All pages with login forms from the Alexa 500 and Phishtank were analyzed. The application works with any authentication technologies which are based on exchange of credentials. Our current prototype is developed for sites supporting both HTTP and HTTPS authentication and accepting email and password pair as login credential. Our algorithm is developed as a separate module which in future can be integrated with browser pluginsthrough an API. We also discuss the design and evaluation of several URL analysis techniques we utilized to reduce false positives and improve the overall performance. Our experiments show that SeleniumPhishGuard is excellent at detecting login phishing forms, correctly classifying approximately 96% of login phishing pages.
Phishing is a nontrivial problem involving deceptive emails and webpages that trick unsuspecting users into willingly revealing their confidential information. In this paper, we focus on detecting login phishing pages, pages that contain forms with email and password fields to allow for authorization to personal/restricted content. We present the design, implementation,and evaluation of our phishing detection tool “SeleniumPhishGuard”, a novel heuristic-based approach to detect phishing login pages. First, the finest existing technologies or techniques that have used similar heuristics we will be discussed and evaluated. The methodology introduced in our paper identifies fraudulent websites by submitting incorrect credentials and analyzing the response. We have also proposed a mechanism for analyzing the responses from server against the submissions of all those credentials to determine thelegitimacy of a given website. The application was implemented in python programming language by utilizing Selenium web testing library, hence “Selenium” is used in the name of our tool. To test the application, a dataset from Alexa top 500 and Phishtank was collected.All pages with login forms from the Alexa 500 and Phishtank were analyzed. The application works with any authentication technologies which are based on exchange of credentials. Our current prototype is developed for sites supporting both HTTP and HTTPS authentication and accepting email and password pair as login credential. Our algorithm is developed as a separate module which in future can be integrated with browser pluginsthrough an API. We also discuss the design and evaluation of several URL analysis techniques we utilized to reduce false positives and improve the overall performance. Our experiments show that SeleniumPhishGuard is excellent at detecting login phishing forms, correctly classifying approximately 96% of login phishing pages.