釣魚網站偵測之研究

Phishing website detection research

江孟哲(Meng-Che Chiang)

指導教授 ： 陳伯榮

淡江大學/工學院/資訊工程學系碩士班/碩士(2021年)

https://doi.org/10.6846/TKU.2021.00513

摘要

近年來釣魚網站數量不斷的在增加和進化，許多釣魚網站的製作者還會使用時事話題或是熱門話題來吸引使用者上當，像是以線上購物有專屬優惠、COVID-19的相關消息…等，網路釣魚在網路的世界中是隨處可見的，這顯然已經成為網路使用者的重大網路安全威脅。在本論文中，我們提出了一種三階段架構式的釣魚網站檢測方法，其依序分為網址黑白名單比對、圖像白名單比對和OCR白名單比對，架構式的檢測流程會使用到相對較多種的演算法，與以往僅使用單一演算法檢測較為不同；由於不同的演算法中的優缺點也不會一樣，因此使用架構式的檢測可以有效整合單一演算法的優缺點並互相補足。除此之外，我們會將已檢測過並且是經過OCR白名單比對後才有結果的網站之網址，依其檢測結果加入至網址黑名單或網址白名單中，更新網址黑白名單的動作是為了避免有重複的輸入檢測而降低檢測的效率，尤其OCR白名單的比對時間較長。
本實驗目前是以中文版以及英文版的Facebook網站為範例來檢測是否為Facebook的相關釣魚網站。經過實驗證明，我們所提出的架構式檢測方法準確率為98.71%，準確率確實皆優於僅使用架構式中各階段的單一比對演算法；由於使用不同的比對方法會在檢測花費的時間上有所差異，但是在正常情況下都不會超過一秒，因此也都是大多數使用者可以接受的範圍內。

關鍵字

釣魚網站 ； 黑白名單 ； 多層演算法

並列摘要

In recent years, the number of phishing websites has continued to increase and evolve. Many phishing website creators also use current affairs topics or hot topics to attract users to be fooled, such as online shopping exclusive discounts, COVID-19 related news... etc. Phishing is everywhere in the Internet world, which makes it obvious that has become a major cyber security threat for Internet users. In this article, we propose a three-stage architecture phishing website detection method, which is divided into URL black and white list comparison, image white list comparison and OCR white list comparison. The architecture detection process will use a lot of multiple algorithms, which is different from only using a single algorithm for detection in the past. Since the advantages and disadvantages of different algorithms are not the same, using of architecture-based detection can effectively integrate the advantages and disadvantages of a single algorithm and influence each other. In addition, we will add the URL of the detected website and the result of the OCR whitelist comparison to the URL blacklist or URL whitelist based on the detection result. The purpose of updating the URL blacklist and whitelist is to avoid repeated input detection and reduce the detection efficiency, especially when the OCR whitelist takes a long time.

This experiment currently uses the Chinese and English version of the Facebook website as an example to detect whether it is a Facebook-related phishing website. Experiments have proved that the accuracy of our proposed architecture detection method is 98.71%, and the accuracy is indeed better than that of using only a single comparison algorithm at each stage of the architecture. Because of using different comparison methods will cause differences in detection time, but under normal circumstances, it will not exceed one second, so it is within the acceptable range of most users.

並列關鍵字

Phishing websites ； Black and white lists ； Multi-layer algorithms

參考文獻

參考文獻

[1] Varsharani Ramdas Hawanna, V. Y. Kulkarni, and R. A. Rane, ❝A novel algorithm to detect phishing URLs,❞ 2016 International Conference on Automatic Control and Dynamic Optimization Techniques (ICACDOT) , Pune, India, 2016.

[2] Luong Anh Tuan Nguyen, Ba Lam To, Huu Khuong Nguyen, and Minh Hoang Nguyen, ❝A novel approach for phishing detection using URL-based heuristic,❞ 2014 International Conference on Computing, Management and Telecommunications (ComManTel), Da Nang, Vietnam, 2014.

[3] 黃冠龍, ❝特定企業之視覺化釣魚網站偵測,❞ 國立台灣科技大學電機工程系碩士學位論文, 2019.

[4] Ankit Kumar Jain and B. B. Gupta, ❝Phishing Detection: Analysis of Visual Similarity Based Approaches,❞ Security and Communication Networks, vol. 2017, National Institute of Technology, Kurukshetra, India, 2017.