Phishing URL Detection: A Real-Case Scenario Through Login URLs

[EN] Phishing is a social engineering cyberattack where criminals deceive users to obtain their credentials through a login form that submits the data to a malicious server. In this paper, we compare machine learning and deep learning techniques to present a method capable of detecting phishing webs...

Descripción completa

Detalles Bibliográficos
Autores: Sanchez Paniagua, Manuel, Fidalgo Fernández, Eduardo, Alegre Gutiérrez, Enrique, Al Nabki, Mohamed Wesam, González Castro, Víctor, Sánchez Paniagua
Tipo de recurso: artículo
Estado:Versión actualizada desde la publicación
Fecha de publicación:2022
País:España
Institución:Universidad de León
Repositorio:BULERIA. Repositorio Institucional de la Universidad de León
OAI Identifier:oai:buleria.unileon.es:10612/22944
Acceso en línea:https://ieeexplore.ieee.org/document/9759382
https://hdl.handle.net/10612/22944
Access Level:acceso abierto
Palabra clave:Informática
Ingeniería de sistemas
Cybercrime
Login
Machine learning
Phishing detection
URL
1203.04 Inteligencia Artificial
1209.03 Análisis de Datos
id ES_efec2a4dbd1d5d239b0411338ceb33f5
oai_identifier_str oai:buleria.unileon.es:10612/22944
network_acronym_str ES
network_name_str España
repository_id_str
spelling Phishing URL Detection: A Real-Case Scenario Through Login URLsSanchez Paniagua, ManuelFidalgo Fernández, EduardoAlegre Gutiérrez, EnriqueAl Nabki, Mohamed WesamGonzález Castro, VíctorSánchez PaniaguaInformáticaIngeniería de sistemasCybercrimeLoginMachine learningPhishing detectionURL1203.04 Inteligencia Artificial1209.03 Análisis de Datos[EN] Phishing is a social engineering cyberattack where criminals deceive users to obtain their credentials through a login form that submits the data to a malicious server. In this paper, we compare machine learning and deep learning techniques to present a method capable of detecting phishing websites through URL analysis. In most current state-of-the-art solutions dealing with phishing detection, the legitimate class is made up of homepages without including login forms. On the contrary, we use URLs from the login page in both classes because we consider it is much more representative of a real case scenario and we demonstrate that existing techniques obtain a high false-positive rate when tested with URLs from legitimate login pages. Additionally, we use datasets from different years to show how models decrease their accuracy over time by training a base model with old datasets and testing it with recent URLs. Also, we perform a frequency analysis over current phishing domains to identify different techniques carried out by phishers in their campaigns. To prove these statements, we have created a new dataset named Phishing Index Login URL (PILU-90K), which is composed of 60K legitimate URLs, including index and login websites, and 30K phishing URLs. Finally, we present a Logistic Regression model which, combined with Term Frequency - Inverse Document Frequency (TF-IDF) feature extraction, obtains 96.50% accuracy on the introduced login URL dataset.SIThis work was supported by the framework agreement between the University of León and INCIBE (Spanish National Cybersecurity Institute) under Addendum 01The authors gratefully acknowledge the support of Nvidia Corporation for their kind donation of GPUs (GeForce GTX Titan X and K-40) that were used in this work.Instituto Nacional de CiberseguridadIEEEIngenieria de Sistemas y AutomaticaEscuela de Ingenierias Industrial, Informática y Aeroespacial2022info:eu-repo/semantics/articleinfo:eu-repo/semantics/updatedVersionhttps://ieeexplore.ieee.org/document/9759382https://hdl.handle.net/10612/22944reponame:BULERIA. Repositorio Institucional de la Universidad de Leóninstname:Universidad de LeónIngléshttp://creativecommons.org/licenses/by/4.0/info:eu-repo/semantics/openAccessoai:buleria.unileon.es:10612/229442026-06-24T12:43:27Z
dc.title.none.fl_str_mv Phishing URL Detection: A Real-Case Scenario Through Login URLs
title Phishing URL Detection: A Real-Case Scenario Through Login URLs
spellingShingle Phishing URL Detection: A Real-Case Scenario Through Login URLs
Sanchez Paniagua, Manuel
Informática
Ingeniería de sistemas
Cybercrime
Login
Machine learning
Phishing detection
URL
1203.04 Inteligencia Artificial
1209.03 Análisis de Datos
title_short Phishing URL Detection: A Real-Case Scenario Through Login URLs
title_full Phishing URL Detection: A Real-Case Scenario Through Login URLs
title_fullStr Phishing URL Detection: A Real-Case Scenario Through Login URLs
title_full_unstemmed Phishing URL Detection: A Real-Case Scenario Through Login URLs
title_sort Phishing URL Detection: A Real-Case Scenario Through Login URLs
dc.creator.none.fl_str_mv Sanchez Paniagua, Manuel
Fidalgo Fernández, Eduardo
Alegre Gutiérrez, Enrique
Al Nabki, Mohamed Wesam
González Castro, Víctor
Sánchez Paniagua
author Sanchez Paniagua, Manuel
author_facet Sanchez Paniagua, Manuel
Fidalgo Fernández, Eduardo
Alegre Gutiérrez, Enrique
Al Nabki, Mohamed Wesam
González Castro, Víctor
Sánchez Paniagua
author_role author
author2 Fidalgo Fernández, Eduardo
Alegre Gutiérrez, Enrique
Al Nabki, Mohamed Wesam
González Castro, Víctor
Sánchez Paniagua
author2_role author
author
author
author
author
dc.contributor.none.fl_str_mv Ingenieria de Sistemas y Automatica
Escuela de Ingenierias Industrial, Informática y Aeroespacial
dc.subject.none.fl_str_mv Informática
Ingeniería de sistemas
Cybercrime
Login
Machine learning
Phishing detection
URL
1203.04 Inteligencia Artificial
1209.03 Análisis de Datos
topic Informática
Ingeniería de sistemas
Cybercrime
Login
Machine learning
Phishing detection
URL
1203.04 Inteligencia Artificial
1209.03 Análisis de Datos
description [EN] Phishing is a social engineering cyberattack where criminals deceive users to obtain their credentials through a login form that submits the data to a malicious server. In this paper, we compare machine learning and deep learning techniques to present a method capable of detecting phishing websites through URL analysis. In most current state-of-the-art solutions dealing with phishing detection, the legitimate class is made up of homepages without including login forms. On the contrary, we use URLs from the login page in both classes because we consider it is much more representative of a real case scenario and we demonstrate that existing techniques obtain a high false-positive rate when tested with URLs from legitimate login pages. Additionally, we use datasets from different years to show how models decrease their accuracy over time by training a base model with old datasets and testing it with recent URLs. Also, we perform a frequency analysis over current phishing domains to identify different techniques carried out by phishers in their campaigns. To prove these statements, we have created a new dataset named Phishing Index Login URL (PILU-90K), which is composed of 60K legitimate URLs, including index and login websites, and 30K phishing URLs. Finally, we present a Logistic Regression model which, combined with Term Frequency - Inverse Document Frequency (TF-IDF) feature extraction, obtains 96.50% accuracy on the introduced login URL dataset.
publishDate 2022
dc.date.none.fl_str_mv 2022
dc.type.none.fl_str_mv info:eu-repo/semantics/article
info:eu-repo/semantics/updatedVersion
format article
status_str updatedVersion
dc.identifier.none.fl_str_mv https://ieeexplore.ieee.org/document/9759382
https://hdl.handle.net/10612/22944
url https://ieeexplore.ieee.org/document/9759382
https://hdl.handle.net/10612/22944
dc.language.none.fl_str_mv Inglés
language_invalid_str_mv Inglés
dc.rights.none.fl_str_mv http://creativecommons.org/licenses/by/4.0/
info:eu-repo/semantics/openAccess
rights_invalid_str_mv http://creativecommons.org/licenses/by/4.0/
eu_rights_str_mv openAccess
dc.publisher.none.fl_str_mv IEEE
publisher.none.fl_str_mv IEEE
dc.source.none.fl_str_mv reponame:BULERIA. Repositorio Institucional de la Universidad de León
instname:Universidad de León
instname_str Universidad de León
reponame_str BULERIA. Repositorio Institucional de la Universidad de León
collection BULERIA. Repositorio Institucional de la Universidad de León
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869423909145673728
score 15,81155

Similares en LA Referencia