Detect phishing by checking content consistency

Phishing is a form of cybercrime used to lure a victim to reveal his/her sensitive personal information to fraudulent web pages. To protect users from phishing attacks, many anti-phishing techniques have been proposed to block suspicious web pages, which are identified against registered black-lists, or checked by search engines. However, such approaches usually have difficulty in keeping up with the rapidly emerging phishing web pages. To lessen this problem, this paper proposes a technique for identifying suspicious web pages, based on the literal and conceptual consistency between the URL and web contents. By using the search logs only as reference data, our approach can achieve 98% accuracy, showing that it is effective in detecting various forms of phishing attack.

1. Introduction

As networking techniques become increasingly easy to use and efficient, more and more people are using the Internet in their everyday lives. However, even though the Internet can facilitate easy access to information, it can also cause users to lose money easily. Phishing attacks are malicious acts that lure victims to reveal sensitive personal information, such as credit card numbers, bank accounts, and passwords, to fraudulent web pages. According to the latest report from the Anti-Phishing Working Group [1], up to 119,101 unique phishing websites were reported in second quarter 2013 alone; over 74% of these targeted online payment services, and finance-related industries.