Proactive Phishing Sites Detection

Phishing is one of the social engineering techniques to steal users' sensitive information by disguising a fake Web site as a trustworthy one. Previous research proposed phishing mitigation techniques, such as blacklist, heuristics, visual similarity, and machine learning. However, these kinds of methods have limitation on the detection of a zero-hour phishing site, a phishing site that no one has noticed yet. This paper presents a new approach to the detection of zero-hour phishing sites: proactive detection. If those malicious sites are detected as early as possible, shutdown by the specialized agencies and mitigation of user damages are expected. We also present a method and system of efficient phishing site detection based on the proactive approach. The method is composed of two major parts: suspicious domain names generation and judgment. The former predicts likely phishing Web sites from the given legitimate brand domain name. The latter scores and judges suspects by calculating various indexes. That is, zero-hour phishing sites can be detected by hypothesis and test cycles. As a result of the preliminary experiment, we detected several zero-hour phishing sites disguising as major brands, including eBay, Google, and Amazon.