使用可信计算技术防范网络仿冒攻击

网络仿冒攻击已经成为互联网上最大的安全威胁之一,给金融机构和普通消费者造成了巨大的损失,严重影响了网上银行和电子商务的发展。我们分析了当前网络浏览器存在的安全漏洞,讨论了在线用户验证的问题,并且提出了使用可信计算平台对在线用户验证的方法。这种方法不仅能使很多网络仿冒攻击失效,而且可以防范其他在线攻击。     

A lightweight and proactive rule-based incremental construction approach to detect phishing scam

The development of digitization over the globe has made digital security inescapable. As every single article on this planet is being digitalized quickly, it is more important to protect those items. Numerous cyber threats effectively deceive ordinary individuals to take away their identifications. Phishing is a kind of social engineering attack where the hackers are using this kind of attack in modern days to steal the user's credentials. After a systematic research analysis of phishing technique and email scam, an intrusion detection system in chrome extension is developed. This technique is used to detect real-time phishing by examining the URL, domain, content and page attributes of an URL prevailing in an email and any web page portion. Considering the reliability, robustness and scalability of an efficient phishing detection system, we designed a lightweight and proactive rule-based incremental construction approach to detect any unknown phishing URLs. Due to the computational intelligence and nondependent of the blacklist signatures, this application can detect the zero-day and spear phishing attacks with a detection rate of 89.12% and 76.2%, respectively. The true positive values acquired in our method is 97.13% and it shows less than 1.5% of false positive values. Thus the application shows the precision level higher than the previous model developed and other phishing techniques. The overall results indicate that our framework outperforms the existing method in identifying phishing URLs.

     

An efficient phishing webpage detector

Phishing attack is growing significantly each year and is considered as one of the most dangerous threats in the Internet which may cause people to lose confidence in e-commerce. In this paper, we present a heuristic method to determine whether a webpage is a legitimate or a phishing page. This scheme could detect new phishing pages which black list based anti-phishing tools could not. We first convert a web page into 12 features which are well selected based on the existing normal and fishing pages. A training set of web pages including normal and fishing pages are then input for a support vector machine to do training. A testing set is finally fed into the trained model to do the testing. Compared to the existing methods, the experimental results show that the proposed phishing detector can achieve the high accuracy rate with relatively low false positive and low false negative rates.     

Five-tier barrier anti-phishing scheme using hybrid approach

ABSTRACT

Though hoaxing people to make financial benefits is an old idea, phishers have realized that social engineering tools for web attacks are relatively easy to execute and are highly profitable over the Internet. One of the threatening criminal activities is phishing, in which the phishers trap users into revealing their identities and financial information to a fraudulent website. Researchers have proposed a number of anti-phishing techniques based on blacklist, whitelist, and visual similarity, but the major disadvantage with such approaches is that they are slow techniques with high false positive rates. For robust detection of phishing attacks, this article uses fundamentals of heuristic factors and a whitelist. The article proposes a safeguard scheme referred as the five-tier barrier hybrid approach. Input to the five-tier barrier is a uniform resource locator (URL), and output of the application is a status of the page (“Secure Connection” representing a legitimate URL, “Phishing Alert” representing phishing URL, and “Query Page” representing that the webpage needs to be processed further/failure of JSoup connection). In comparison to a blacklist, the five-tier barrier is competent in detecting zero-hour phishing attacks, and it is much faster than visual similarity–based anti-phishing techniques.     

Spike in phishing and malware a danger to IT

Security firms are reporting that IT departments must be careful of increased threats to corporate networks and data from phishing and malware attacks. There are 33 million unique phishing messages every week, according to Dave Cole, director of security product management at Symantec Security Response. He says this plus an increase in the distribution of malware designed to steal confidential information presents a challenge for IT. Phishing, according to the Anti-Phishing Working Group (APWG), an industry association devoted to eliminating phishing, is definable as attacks that "use both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials." Corporations often find that they are victims of another type of phishing attack in which attackers use their good brand names and logos to trick people into responding to bogus solicitations. Although basic security approaches can protect against phishing and malware, Cole says it is also important to have "good Internet security hygiene" and multiple levels of protection for mail clients, servers, and client machines.     

Detection of phishing attacks in Iranian e-banking using a fuzzy–rough hybrid system

Phishing is a method of stealing electronic identity in which social engineering and website forging methods are used in order to mislead users and reveal confidential information having economic value. Destroying the trust between users in business network, phishing has a negative effect on the budding area of e-commerce. Developing countries such as Iran have been recently facing Internet threats like phishing, whose methods, regarding the social differences, may be different from other experiences. Thus, it is necessary to design a suitable detection method for these deceits. The aim of current paper is to provide a phishing detection system to be used in e-banking system in Iran. Identifying the outstanding features of phishing is one of the important prerequisites in design of an accurate system; therefore, in first step, to identify the influential features of phishing that best fit the Iranian bank sites, a list of 28 phishing indicators was prepared. Using feature selection algorithm based on rough sets theory, six main indicators were identified as the most effective factors. The fuzzy expert system was designed using these indicators, afterwards. The results show that the proposed system is able to determine the Iranian phishing sites with a reasonable speed and precision, having an accuracy of 88%.     

基于LVQ神经网络的反网络钓鱼技术研究简

随着网上金融和电子商务的迅速发展,在线购物、网上理财的用户数量急速上升,人们日益享受着互联网带来的便利,与此同时,以网上理财、在线购物等电子商务用户为主要攻击目标的网络钓鱼活动也迅速蔓延。网络钓鱼严重损害了网络用户以及网络服务提供商的利益,影响我国电子商务的发展。本文提出了一种基于LVQ神经网络的反钓鱼技术,通过综合分析钓鱼网址的URL特征和页面特征,并进行自动分类,取得了良好的检测效果。     

Usability evaluation of anti-phishing toolbars

Phishing is considered as one of the most serious threats for the Internet and e-commerce. Phishing attacks abuse trust with the help of deceptive e-mails, fraudulent web sites and malware. In order to prevent phishing attacks some organizations have implemented Internet browser toolbars for identifying deceptive activities. However, the levels of usability and user interfaces are varying. Some of the toolbars have obvious usability problems, which can affect the performance of these toolbars ultimately. For the sake of future improvement, usability evaluation is indispensable. We will discuss usability of five typical anti-phishing toolbars: built-in phishing prevention in the Internet Explorer 7.0, Google toolbar, Netcraft Anti-phishing toolbar and SpoofGuard. In addition, we included Internet Explorer plug-in we have developed, Anti-phishing IEPlug. Our hypothesis was that usability of anti-phishing toolbars, and as a consequence also security of the toolbars, could be improved. Indeed, according to the heuristic usability evaluation, a number of usability issues were found. In this article, we will describe the anti-phishing toolbars, we will discuss anti-phishing toolbar usability evaluation approach and we will present our findings. Finally, we will propose advices for improving usability of anti-phishing toolbars, including three key components of anti-phishing client side applications (main user interface, critical warnings and the help system). For example, we found that in the main user interface it is important to keep the user informed and organize settings accordingly to a proper usability design. In addition, all the critical warnings an anti-phishing toolbar shows should be well designed. Furthermore, we found that the help system should be built to assist users to learn about phishing prevention as well as how to identify fraud attempts by themselves. One result of our research is also a classification of anti-phishing toolbar applications. Linfeng Li is a student at the University of Tampere, Finland. Marko Helenius is Assistant Professor at the Department of Computer Sciences, University of Tampere, Finland.     

Phishing threat avoidance behaviour: An empirical investigation

Phishing is an online identity theft that aims to steal sensitive information such as username, password and online banking details from its victims. Phishing education needs to be considered as a means to combat this threat. This paper reports on a design and development of a mobile game prototype as an educational tool helping computer users to protect themselves against phishing attacks. The elements of a game design framework for avoiding phishing attacks were used to address the game design issues. Our mobile game design aimed to enhance the users' avoidance behaviour through motivation to protect themselves against phishing threats. A think-aloud study was conducted, along with a pre- and post-test, to assess the game design framework though the developed mobile game prototype. The study results showed a significant improvement of participants' phishing avoidance behaviour in their post-test assessment. Furthermore, the study findings suggest that participants' threat perception, safeguard effectiveness, self-efficacy, perceived severity and perceived susceptibility elements positively impact threat avoidance behaviour, whereas safeguard cost had a negative impact on it.     

规避网络钓鱼给证券行业带来的安全风险

网上交易作为证券行业进行业务开展的主要手段之后,网上交易的安全性就成了人们日益关注的话题。在网上交易过程中,钓鱼网站攻击是一种重要的攻击方式。由于此方式的特殊性,导致被害用户损失严重。所以做好对钓鱼网站的防范,对于证券行业具有很大现实意义。本文从钓鱼网站的实施过程、社会危害、防范方法等几个角度,对网络钓鱼进行全面地阐述。详细的描述了恶意份子如何引导用户去访问恶意网站。详细的描述了网络钓鱼的主要防范技术,如黑白名单检测技术、页面相似度检查技术。从技术角度和用户的上网行为角度,提出了相关的方法,尽量规避网络钓鱼技术给证券行业带来的安全风险。     

基于集成学习的钓鱼网页深度检测系统

网络钓鱼是一种在线欺诈行为,它利用钓鱼网页仿冒正常合法的网页,窃取用户敏感信息从而达到非法目的.提出了基于集成学习的钓鱼网页深度检测方法,采用网页渲染来应对常见的页面伪装手段,提取渲染后网页的URL信息特征、链接信息特征以及页面文本特征,利用集成学习的方法,针对不同的特征信息构造并训练不同的基础分类器模型,最后利用分类集成策略综合多个基础分类器生成最终的结果.针对PhishTank钓鱼网页的检测实验表明,本文提出的检测方法具有较好的准确率与召回率.     

Security awareness of computer users: A phishing threat avoidance perspective

Phishing is an online identity theft, which aims to steal confidential information such as username, password and online banking details from its victims. To prevent this, anti-phishing education needs to be considered. Therefore, the research reported in this paper examines whether conceptual knowledge or procedural knowledge has a positive effect on computer users’ self-efficacy to thwart phishing threats. In order to accomplish this, a theoretical model based on Liang and Xue’s (2010) Technology Threat Avoidance Theory (TTAT) has been proposed and evaluated. Data was collected from 161 regular computer users to elicit their feedback through an online questionnaire. The study findings revealed that the interaction effect of conceptual and procedural knowledge positively impacts on computer users’ self-efficacy, which enhances their phishing threat avoidance behaviour. It can therefore be argued that well-designed end-user security education contributes to thwart phishing threats.     

网络钓鱼分析与防范

随着互联网应用在我国的飞速发展,网络钓鱼的数量也在迅速增加,给我国的互联网用户和企业造成了极大的经济损失,严重阻碍了在线金融、电子商务应用的健康发展.面对网络钓鱼的日益肆虐,仅靠增强网民的主动防范意识来避免"网络钓鱼"是远远不够的.在分析网络钓鱼欺骗伎俩和破解技巧的基础上,着重对互联网应用企业提出了几条建议,以加强其对...     

Obtaining the threat model for e-mail phishing

Phishing is a kind of embezzlement that uses social engineering in order to obtain personal information from its victims, aiming to cause losses. In the technical literature only the hit rate of the classifiers is mentioned to justify the effectiveness of the phishing detecting techniques. Aspects such as the accuracy of the classifier results (false positive rate), computational effort and the number of features used for phishing detection are rarely taken into account. In this work we propose a technique that yields the minimum set of relevant features providing reliability, good performance and flexibility to the phishing detection engine. The experimental results reported in this work show that the proposed technique could be used to optimize the detection engine of the anti-phishing scheme.     

基于异常特征的钓鱼网站URL检测技术

典型的网络钓鱼是采用群发垃圾邮件,欺骗用户点击钓鱼网站URL地址,登录并输入个人机密信息的一种攻击手段。文章通过分析钓鱼网站URL地址的结构和词汇特征,提出一种基于异常特征的钓鱼网站URL检测方法。抽取钓鱼网站URL地址中4个结构特征、8个词汇特征,组成12个特征的特征向量,用SVM进行训练和分类。对PhishTank上7291条钓鱼网站URL分类实验,检测出7134条钓鱼网站URL,准确率达到97.85%。     

Intelligent phishing detection and protection scheme for online transactions

Phishing is an instance of social engineering techniques used to deceive users into giving their sensitive information using an illegitimate website that looks and feels exactly like the target organization website. Most phishing detection approaches utilizes Uniform Resource Locator (URL) blacklists or phishing website features combined with machine learning techniques to combat phishing. Despite the existing approaches that utilize URL blacklists, they cannot generalize well with new phishing attacks due to human weakness in verifying blacklists, while the existing feature-based methods suffer high false positive rates and insufficient phishing features. As a result, this leads to an inadequacy in the online transactions. To solve this problem robustly, the proposed study introduces new inputs (Legitimate site rules, User-behavior profile, PhishTank, User-specific sites, Pop-Ups from emails) which were not considered previously in a single protection platform. The idea is to utilize a Neuro-Fuzzy Scheme with 5 inputs to detect phishing sites with high accuracy in real-time. In this study, 2-Fold cross-validation is applied for training and testing the proposed model. A total of 288 features with 5 inputs were used and has so far achieved the best performance as compared to all previously reported results in the field.     

网络钓鱼防御方法研究

网络钓鱼主要是指利用互联网进行的一种欺诈行为。随着互联网的广泛普及,针对在线身份窃取的网络钓鱼活动日益加剧。阐述了网络钓鱼的基本概念;对现有的网络钓鱼的攻击方式进行了较为全面的分类总结,在此基础上对目前主要的反钓鱼方法进行了分类研究,并对各种方法的优缺点进行了相应的分析;提出网络钓鱼在三个方面的发展趋势,并得出结论：只有将各种防御方法很好地结合起来才能更好地应对手段不断翻新的网络钓鱼攻击。     

利用图像识别技术过滤海量可疑钓鱼网站

网络钓鱼攻击（phishing,又称钓鱼攻击、网络钓鱼）作为一种主要基于互联网传播和实施的新兴攻击、诈骗的方式,正呈逐年上升之势,使广大用户和金融机构遭受到财产和经济损失。如何及时、有效地识别网络钓鱼相关的互联网风险,控制钓鱼攻击可能带来的影响,已经成为各金融机构当前亟待解决的问题。因此,各大银行、证券公司以及安全公司纷纷推出自己的反钓鱼监控服务,目前的反钓鱼技术普遍采取利用爬虫主动进行大范围互联网仿冒站点的搜素,爬取大量可疑钓鱼网站,并逐一对可疑钓鱼网站进行检测,判断其是否为钓鱼网站。面对海量可疑网站,如何高效快速地检测出可疑钓鱼网站又成为一个难题。文中介绍了一种基于图像识别技术的网站徽标（LOGO）检测的新思路,用于过滤海量的可疑钓鱼网站,加快钓鱼网站的检测效率。     

网络钓鱼犯罪分析

随着计算机网络的发展不断进步,许多涉计算机犯罪不断出现。"网络钓鱼犯罪"就是其中的一种。本文试就网络钓鱼犯罪的特点、手段、涉及的法律问题及其相应的防范工作等方面作一些探讨。