IRJET- Anti-Phishing Technology using New Compression based Algorithm (PhishZip)

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

Anti-Phishing Technology using New compression based Algorithm (PhishZip) Achu Thomas Philip1, Ajeesh S.2, Dr. Smita C Thomas3 1M

Tech Student, APJ Abdul Kalam Technological University, Kerala, India Professor, Mount Zion College of Engineering, Kadammanitta, Kerala, India 3Assoc. Professor, Mount Zion College of Engineering, Kadammanitta, Kerala, India ---------------------------------------------------------------------***---------------------------------------------------------------------2Asst.

Abstract - Phishing is a technique to gain personal

compression for each class. Using these models, we can perform classification by comparing the compression ratios of both models. We expect that a phishing optimised model should compress phishing websites better than a nonphishing optimised compression model, resulting in a higher compression ratio, and vice versa. The main tool that we use in this work is the zlib library, which is based on the DEFLATE compression algorithm [11].DEFLATE is a lossless data compression algorithm used for compressing websites in HTTP [12][1]. We introduce a systematic process of selecting meaningful words which are associated with phishing and non-phishing websites by analysing the likelihood of word occurrences and calculate the optimal likelihood threshold. These set of words are used as the predefined compression dictionary for our compression models. We develop a tool called PhishZip which performs phishing website detection using the DEFLATE compression algorithm. To the best of our knowledge, this study is the first to use compression algorithms to perform phishing website classification. Unlike machine learning based models, performing classification by leveraging compression algorithms does not require training the models not or performing HTML parsing [13]. Thus, classification with compression algorithms is faster and simpler. We propose the use of compression ratio as a novel machine learning feature which is robust and easy to extract. Compression ratio measures the distance or cross-entropy between the predicted website and phishing/non-phishing website content distribution. The high compression ratio is associated with low cross-entropy, which indicates that the content distribution is similar to the common word distribution in phishing/non-phishing websites [13][14].The paper is organised as follows. In section II, we provide an overview of past studies in phishing detection systems and compression based classification. Section III provides some background regarding phishing and the concept of compression-based classification. Section IV gives the system overview of PhishZip. We provide the word occurrence likelihood analysis for constructing the word dictionary of the compression models in Section V. The experimental setups, including the evaluation methodology and diversity of our web page corpus, are presented in Section VI. We provide the performance evaluation results in Section VII and provide more analysis regarding these results in Section VIII. Finally, we wrap up with conclusions in Section IX.

information for the purpose of identity theft, usually by means of fraudulent E-mail. In this paper we propose PhishZip which is a novel phishing detection approach using a compression algorithm to perform website classification and demonstrate a systematic way to construct the word dictionaries for the compression models using word occurrence likelihood analysis. PhishZip outperforms the use of best-performing HTML-based features in past studies, with a true positive rate of 80.04%. We also propose the use of compression ratio as a novel machine learning feature which significantly improves machine learning based phishing detection over previous studies. Using compression ratios as additional features, the true positive rate significantly improves by 30.3% (from 51.47% to81.77%), while the accuracy increases by 11.84% (from 71.20% to 83.04%).

Key Words: Phishing,

Anti-phishing, Compression,

classification.

1. INTRODUCTION Phishing is a social engineering attack that aims at exploiting the weakness found in the system at the user’s end. Phishing attacks are the most common type of attacks leveraging social engineering techniques. Attackers use emails, social media to trick victims into providing sensitive information or visiting malicious URL (Uniform Resource Locator) in the attempt to compromise their systems. To mitigate the negative impacts of phishing, security soft-ware providers, financial institutions, and academic researchers have studied various approaches to build an automated phishing website detection system. These methods include the use of blacklists and detecting phishing websites by investigating the website content, URL, and web-related features [6]– [10].While most past studies in phishing detection focused on the use of machine learning algorithms, this study introduces the use of compression algorithms to perform phishing website classification. The compression-based classification process aims to predict whether a certain website is phishing or benign based on the textual information. To perform this task, we built two compression models which are optimised for phishing and benign websites respectively. Building these models requires information regarding the word distribution in phishing and benign websites, which is required to optimise the

© 2021, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 976

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

measure the similarity between the protected web page and suspicious web pages. A text classifier, an image classifier, and an algorithm fusing the results from classifiers are introduced. An outstanding feature of this paper is the exploration of a Bayesian model to estimate the matching threshold. This is required in the classifier for determining the class of the web page and identifying whether the web page is phishing or not. In the text classifier, the naive Bayes rule is used to calculate the probability that a web page is phishing. In the image classifier, the earth mover’s distance is employed to measure the visual similarity, and our Bayesian model is designed to determine the threshold[2]. In the data fusion algorithm, the Bayes theory is used to synthesize the classification results from textual and visual content. The effectiveness of our proposed approach was examined in a large-scale dataset collected from real phishing cases. Experimental results demonstrated that the text classifier and the image classifier we designed deliver promising results, the fusion algorithm outperforms either of the individual classifiers, and our model can be adapted to different phishing cases.

Fig0: Gmail Phishing Scam URL The Fig. 0 looks exactly like a Gmail sign-in form, the URL is slightly changed, but it’s not filling in this form would give the attacker full access to the victim’s Gmail account. The kind of theft and fraud that could take place by just acquiring the details of someone’s or some organizations’ account couldn’t really be imagined. All other account are controlled by the Gmail account. That could be a huge threat. Microsoft Outlook fraud is the second-most targeted and Google drive being the third. Other targets are Facebook, bank logins and Pay-tm, Pay-pal, etc.

Gold Phish: Using Images for Content-Based Phishing Analysis: - Attacks that exploit human vulnerabilities have been on the rise in recent years. Some of the most common attacks that fall into this category are phishing attacks.

Phishing attacks generally use emails in an attempt to lure unsuspecting users into entering personal information such as credit card numbers or bank account numbers into fake web sites. The fake web sites are designed to look exactly like the authentic web site. Many times even the Uniform Resource Locater (URL) is similar to the authentic site’s URL. Studies have shown that even the most computer-savvy users will fall victim to phishing sites. In the first half of 2009 alone, there were 30,131 unique domain names conducting phishing attacks.[7][9] A report from late 2007 attributed the loss of more than $3 billion to phishing attacks. The same report shows that 3.6 million people lost money to phishing attacks. There have been many tools developed to combat phishing attacks. Most anti-phishing methodologies in use today take advantage of databases that produce a blacklist of known phishing sites. There are a number of disadvantages to this approach. First, this approach relies upon a complete database of all known phishing sites[8][9]. In that respect, the anti-phishing tool is only as good as the completeness of its database. This is compounded by the fact that the average phishing site is active for only a couple of days, some only for a few hours. Second, this approach does not protect against zero-day phishing attacks; that is, new phishing attacks that the community is unaware of. On average, 82 new phishing sites pop up every day[13]. We propose an approach that solves the problems that database techniques face by detecting zero-day phishing attacks. Our tool, called GoldPhish, uses a browser plug-in to detect and report phishing sites. We do this by using optical character recognition (OCR) to read the text from an image of the page (specifically from the company logo), grabbing the top ranked domains from a search engine, and comparing them with the current

1.1 ANTI-PHISHING An Anti-phishing service is a technological service that helps prevent unauthorized access to secure and/or sensitive information.

1.1.1 ANTI-PHISHING SERVICES An anti-phishing service addresses a specific type of attempt to obtain personal or other sensitive information. While antiphishing services provide tools to help users recognize Web phishing, many anti-phishing service features are responses to efforts to hack a system and steal data. Some anti-phishing tools are available via web applications, through which many phishing attempts occur. Some anti-phishing services include sophisticated planning designed to help clients avoid data theft. For example, a quick response to unauthorized access is key to a successful “phishing incident response plans.

"Anti-phishing services or tools often provide specific components that help analyse how data is stolen, how data may be recovered or how to close ranks and protect a system from additional hacking. As expert ‟s prophecy the rise of more sophisticated phishing, new anti-phishing services often address these directly with more innovative features and components.

2. RELATED WORK Textual and Visual Content-Based Anti-Phishing: A Bayesian Approach: - A novel framework using a Bayesian approach for content-based phishing web page detection is presented.

Our model takes into account textual and visual contents to

© 2021, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 977

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

web site. The strength of our tool lies in the user’s ability to recognize well-known company logos. A phishing site cannot change a well-known company logo without the phishing target noticing.

Schrader in [10] discussed the use of Prediction by Partial Matching (PPM) to perform sentiment polarity classification.

Compression algorithms have also been used to perform classification of amino acid sequences of DNA as discussed in [11]. Y. Sönmez [2] proposes a classification model in order to classify the phishing attacks. This model comprises of feature extraction from sites and classification of website. In feature extraction, 30 features has been taken from UCI Irvine machine learning repository data set and phishing feature extraction rules has been clearly defined. In order to classification of these features, Support Vector Machine (SVM), Naïve Bayes (NB) and Extreme Learning Machine (ELM)[2] were used. In Extreme Learning Machine (ELM), six activation functions were used and achieved 95.34% accuracy than SVM and NB. The results were obtained with the help of MATLAB. Y. Zeng [1] proposed a phishing detection model to detect the phishing performance effectively by using mining the semantic features of word embedding, semantic feature and multi-scale statistical features [4] in Chinese web pages. Eleven features were extracted and categorized into five classes to acquire statistical features of web pages. Ada Boost, Bagging, Random Forest and SMO [5] are used to implement learning and testing the model. Legitimate URLs dataset obtained from Direct Industry web guides and phishing data was obtained from Anti-Phishing Alliance of China. According to study, only semantic features well identified the phishing sites with high detection [3] efficiency and fusion model achieved the best performance detection. This model is unique to Chinese web pages and it has dependency in certain language. Many researchers have previously been carried out in this field of phishing detection. Gathered the information from various such works and have profoundly reviewed them which has helped us in motivating our own methodologies in the process of making a more secure and accurate system. Detecting and preventing the Phishing Websites using Machine Learning Approach is a mechanism that is proposed in order to ensure high security. In this mechanism we deal with the URLs and the URL check with machine learning technique and predict is it is phishing website or not. The SVM algorithm is applied to categories the phishing and malware site. SVM is machine learning algorithm. SVMs classify data by determining a set of support vectors, which are members of the set of training inputs that outline a hyper plane in the feature space. Random forest is machine learning algorithm. Random forest is a supervised learning algorithm which is used for both classification as well as regression. But however, it is mainly used for classification problems. As we know that a forest is made up of trees and more trees means more robust forest. Similarly, random forest algorithm creates decision trees on data samples and then gets the prediction from each of them and finally selects the best solution by means of voting. It is an ensemble method which is better than a single decision tree because it reduces the over-fitting by averaging the result.

Real Time Detection of Phishing Websites: Web Spoofing lures the user to interact with the fake websites rather than the real ones. The main objective of this attack is to steal the sensitive information from the users. The attacker creates a shadow website that looks similar to the legitimate website.

This fraudulent act allows the attacker to observe and modify any information from the user. This paper proposes a detection technique of phishing websites based on checking Uniform Resources Locators (URLs) of web pages. The proposed solution is able to distinguish between the legitimate web page and fake web page by checking the Uniform Resources Locators (URLs) of suspected web pages.

URLs are inspected based on particular characteristics to check the phishing web pages. . Phishing websites look very similar in appearance to their corresponding legitimate websites to attract large number of Internet users. The detected attacks are reported for prevention. The performance of the proposed solution is evaluated using Phis-tank and Yahoo directory datasets. The obtained results show that the detection mechanism is Deployable and capable to detect various types of phishing attacks maintaining a low rate of false alarms.

Several past studies in phishing website detection systems have been conducted, mainly focusing on the use of machine learning algorithms to classify phishing websites based on specific features. Whittaker et al. introduced a machine learning classifier for automatically maintaining Google’s phishing blacklist using features extracted from the URL, page hosting information, and the page content [10], [12].

Meanwhile, Xiang et al. proposed CANTINA+ as a comprehensive framework for detecting phishing websites using URL-based, HTML based, and web-based features [6].

The study by Xiang et al. extends CANTINA, which performs phishing detection based on TF-IDF information retrieval algorithm and seven other content-based heuristics, including age of domain, logo image and domain name inconsistency, and suspicious links in the HTML [8]. Xiang and Hong also studied the use of identity discovery as a hybrid phishing detection approach [7]. Meanwhile, Zhang et al. [9] proposed content-based phishing website detection by analysing the website textual and visual content and assessing its similarity. In a recent study, Quinkert et al. [12] focused on observing the use of homograph domains to identify scamming and phishing. In contrast, our work leverages compression algorithm to perform classification which has not been implemented for phishing detection in past studies. A number of studies have previously discussed the use of data compression algorithm to perform text classification in various areas. Marton et al. in [11] evaluated the performance of various compression-based classification methods to classify text based on topic/genre and authorship attribution. Meanwhile, Ziegelmayer and

© 2021, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 978

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

3. PROPOSED SYSTEM

C. DEFLATE Algorithm In this study, the use DEFLATE lossless compression algorithm which is one of the compression schemes used in the HTTP standard for minimising latency by reducing the byte size transferred across the network. In Web browsers, two of the three encodings defined in the HTTP specification (”Content-Encoding: gzip “and “Content-Encoding: deflate”) are based on the DEFLATE algorithm. The DEFLATE algorithm mainly consists of the LZ77 algorithm and Huffman encoding. LZ77 is a dictionary-based Lempel-Ziv compression algorithm which aims to eliminate duplicate bytes by replacing recurring bytes in the data with a backreference which points to the first occurrence of the bytes.

The next step is using Huffman coding for replacing symbols with new weighted symbols depending on the frequency of occurrence. Thus, symbols which frequently show up are replaced with shorter symbol representations, and vice versa. It uses the zlib data compression library which provides an abstraction of the DEFLATE compression algorithm. The zlib module in Python includes functions which implement data compression and decompression using the DEFLATE algorithm and provides the functionality to set a predefined zlib compression dictionary [8][2]. This word dictionary can help to improve the compression result and should contain a list of bytes or strings which are expected to occur frequently in the data. In this study, we built two word-dictionaries, which consist of common words in phishing and non-phishing websites respectively. With these two dictionaries performed compression on the same document twice using each dictionary separately. Ideally, compressing phishing website content using the phishing dictionary should produce a more compressed output than using the non-phishing dictionary and vice versa.

3.1 GENERAL BACKGROUND In this section provide background on phishing, compression-based classification, and a brief description of the DEFLATE compression algorithm.

A. Phishing Phishing is a social engineering attack which aims at stealing user account credentials by impersonating legitimate organisations or institutional websites. Several motives underlie these attacks, such as financial gain or stealing identities for hiding illegal actions. To perform phishing, attackers typically broadcast emails to the victims with urgent calls to a particular action, e.g. account subscription status or password reset due to a data breach, with a URL redirecting to these phishing websites.

B. Compression-Based Classification Text categorisation tasks assign each document to one of the pre-set categories. Various machine learning algorithms have been used in several studies to perform text categorisation tasks, such as Naive Bayes, SVM, and deep learning methods. Machine learning based text classification typically consists of four steps: (1) Word and sentence segmentation on the training files (2) Feature selection based on the word counts (3) Building a model based on a machine learning algorithm (4) Performing feature extraction on the testing files and evaluating the model on this test data.

3.2 SYSTEM OVERVIEW

Compared to the standard machine learning approach for classification, compression-based methods are relatively easy to apply and do not require further input document pre-processing or feature extraction[9]. Data compression algorithms build a model of the processed documents based on extensive statistics regarding these documents. Text classification is performed by compressing the documents using compression models optimised for each class of document. After obtaining the compression results, each document is assigned to the pre-set category which results in the highest compression rate, indicating the best compression. From the perspective of information theory, the compression rate is related to the cross-entropy between the distribution of the class text corpus and the text distribution of the predicted document. By choosing the class model which performs the best for the predicted document, the classification is essentially performed by choosing the category whose text corpus minimises this cross-entropy. In this study, we leverage a compression algorithm as a novel approach to perform phishing website classification. Further details regarding the DEFLATE algorithm that we use are provided in the following subsection.

© 2021, IRJET

|

Impact Factor value: 7.529

This section contains a description regarding the design of PhishZip detection system. There are two main modules in PhishZip, which are the dictionary builder module and compression model.

A. Dictionary Builder This module aims at creating word dictionaries to build compression models optimised for phishing websites and non-phishing websites respectively. To build these dictionaries, calculate the likelihood of words occurring in each website class (i.e. phishing and non-phishing) and selecting a minimum likelihood threshold value. The words in the dictionaries are those whose likelihood of occurring in a certain website class is greater than a certain threshold.

The word occurrence likelihood in a specific website class is proportional to the word frequency in this class; thus, words which show up more often will be assigned higher likelihood values. Meanwhile, this likelihood value should be comparable for both website classes. Thus, for an arbitrary word, if its likelihood value of occurrence in phishing websites is higher than in non-phishing websites, we should

|

ISO 9001:2008 Certified Journal

|

Page 979

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

expect the word to appear more often in phishing websites, which indicates higher association to phishing websites than non-phishing websites.

compression models also performed an analysis to select the optimal likelihood threshold for constructing the common word dictionary which leads to the best classification performance. Before performing these analyses, it performed some data pre-processing to obtain the website textual contents. These processes will be described further in the following subsections.

To estimate the likelihood of a word wk occurring in a certain text category vj element of {phishing; non-phishing (either ‘phishing’ or ’non-phishing’), we adopt the m-estimate with uniform priors and set m = IVI j (the size of the word vocabulary V ). More formally,

(1) Here, n is the total number of word positions in all training examples whose target value is vj , nk is the number of times the word wk is found in all the n word positions, and IVI is the total number of distinct words and other tokens in all examples.

Fig1. PhishZip Compression-Based Classification Model To perform this analysis, we use a set of website HTML contents which consist of 5,000 phishing and 5,000 nonphishing websites. These website contents were manually collected by fetching the content of phishing website URLs from Phish Tank and safe website URLs listed by Quant cast using curl to securely inspect the website contents without running any potentially malicious code on the browser. As we focus on the textual information in the website, performed data pre-processing to extract text from the website HTML content and removed common English stop words (e.g. ”the”, ”a”, ”an”) as specified in Natural Language Toolkit (NLTK) library. After performing these data preprocessing steps, we obtained a collection of phishing and non-phishing website textual contents which were used to perform word occurrence likelihood analysis. To observe the word distribution in both classes and how distinctive they are, we plot the frequency of words in both phishing and non-phishing text corpora. We normalised the word frequency by dividing the value by the length of phishing or non-phishing text corpus to show the frequency of word occurrence relative to the total number of words in the corpus.

B. Compression-Based Classification Model To perform the classification task, build two compression models optimised for phishing websites and non-phishing websites respectively. The phishing optimised compression model uses the phishing dictionary, while the non-phishing optimised compression model uses the non-phishing dictionary as the pre-set compression dictionary. These dictionaries are constructed from the dictionary builder process as discussed in the previous subsection.[1] To perform website classification, compress the raw website HTML content using the phishing optimised model and nonphishing optimised model separately. There are two separate compression outputs from this process. Compare these outputs by calculating the compression ratio, which is the ratio of the original input size to the compression output size.

(2) Here, Ci indicates the compression model and HTML_ content is the raw website content. The decision on whether the website is classified as phishing or non-phishing is based on which compression model produces the higher compression ratio, i.e. if the phishing optimised compression model produces a better compression ratio than the non-phishing optimised model, then the website is classified as phishing, and vice versa. An illustration of the compression-based classification model is shown in Figure 1.

4. RESULTS In this section, we provide the results of two experiments conducted in this study: the first experiment examines the performance of PhishZip as a compression based classification method for detecting phishing websites, while the second experiment investigates the performance of website compression ratio as a viable machine learning feature for phishing detection systems.

3.3 WORD OCCURRENCE LIKELIHOOD ANALYSIS The compression-based classification mainly relies on word distribution differences in each class. Thus, we performed analysis to observe the word distribution in the website textual contents and calculate the likelihood of word occurrences in phishing and non-phishing websites. This information is useful to build the dictionary of common words in phishing and non-phishing websites for the

© 2021, IRJET

|

Impact Factor value: 7.529

A. PhishZip Performance Evaluation To assess the performance of PhishZip, we compress each website in the phishing and non-phishing evaluation dataset with compression models optimised for phishing and nonphishing websites respectively and then compare the compression ratio of each model. Phishing websites are expected to have higher compression ratio using phishing

|

ISO 9001:2008 Certified Journal

|

Page 980

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

optimised compression model than non-phishing compression model, and vice versa. By performing classification using compression algorithms alone, we are able to detect phishing websites with a true positive rate of 80.04%, false positive rate of 18.25%, and accuracy of 80.89%. As a comparison, we also perform phishing website classification with features proposed by Xiang et al. in CANTINA+ [6]. We choose the features proposed in this study as they provide comprehensive results regarding the performance of the system and each individual feature. In their study of CANTINA+, Xiang et al. investigated the performance of various URL-based features, HTML-based features, and Web based features. The top-performing features are page in top search results, bad forms, bad action fields, and non-matching URLs. As our work focuses on website content based features, we compare the performance of PhishZip with top-performing HTML-based features only, which are bad forms, bad action fields, and non-matching URLs. A summary of the performance evaluation results of PhishZip and the selected features in CANTINA+ [11][10]. We found that the machine learning model achieved an accuracy of 71.20%, low false positive rate around 8.92%, and relatively low true positive rate of roughly 51.47%. These results show that while the use of these HTML-based features still produce in a relatively descent accuracy and low false positive rate, they did not perform well in detecting phishing websites as reflected by the true positive rate. Meanwhile, as shown in Table III, PhishZip outperforms the use of HTML based features in CANTINA+ with a true positive rate of 80.04%, false positive rate of 18.25%, and accuracy of 80.89%.

positive rate of 80.04%. The use of compression ratios as an additional feature to add with CANTINA+ features is able to significantly improve the machine learning

B. Compression Ratios as Machine Learning Features

Due to the rise in the number of users accessing the Internet through smart phones, social networking websites have expanded their services on smart phones, including messaging, chatting, photo viewing, etc. This increase in users has opened more doors to attackers because there are now more potential victims. Hence, attackers have created phishing websites on social networking brands claiming to provide these services on smart phones.

Table1

5. APPLICATIONS The popularity of applications on social networking websites has increased a great deal this year. This has led to a new wave of phishing attacks targeting the users of these applications. Symantec has examined phishing websites exploiting three major social networking brands. The fake websites display attractive offers on the social networking applications to lure end users. Some of the applications that the phishing sites were based on are: 1. Social networking on mobile

Compression ratio is a novel machine learning feature. To the best of our knowledge, this has not been applied to detect phishing websites in past studies. Compression ratio is also relatively robust against the dynamic behaviour of phishing, as we could easily update the predefined word dictionaries and optimise the compression models correspondingly. Calculating compression ratio is relatively easy, as website browsers perform website compression frequently to improve user experience when opening websites [5]. As defined in HTTP specification, compression is one of the options in the standard for minimising latency during data transfer over the internet [12] and is a built-in feature in current Web browsers [5]. This could be incorporated through protocol option support, where no recompression may be needed. These characteristics make compression ratio as a viable option as a machine learning feature for performing phishing detection.

2. Live chat In November, Symantec observed that five percent of the targeted applications were on live chat, and among them adult sex chat was the most common target. The phishing attacks show fake offers of free sex chat to lure end users into entering their login credentials.

6. CONCLUSIONS In this paper, PhishZip as a novel approach to perform phishing website classification using a dictionary based compression algorithm. This method leverages word dictionaries constructed by analysing the word occurrence likelihood, which is also demonstrated in this work. PhishZip out performs the use of best-performing HTML-based features proposed in past studies with a true positive rate of

In this study, we propose the use of compression algorithm to perform phishing website classification. The compression ratio measures the cross entropy between the distribution of the website content we are trying to classify and the word distribution of phishing or non-phishing websites. PhishZip outperforms the performance of top performing HTMLbased features proposed in CANTINA+ [6], achieving a true

© 2021, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 981

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 08 Issue: 03 | Mar 2021

p-ISSN: 2395-0072

www.irjet.net

80.04%. We also introduced the use of compression ratio as a novel machine learning feature which has shown to significantly improve past studies in machine learning based phishing detection systems. Using compression ratios as additional features, the true positive rate has significantly improved by around 30.3%, from 51.47% to 81.77%, while the accuracy increased roughly by 11.84%, from 71.20% to 83.04%.

R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, andT. Berners-Lee, “Hypertext transfer protocol – http/1.1,” United States,1999.

[14] Y. Zhang, J. I. Hong, and L. F. Cranor, “Cantina: A contentbased approach to detecting phishing web sites,” in Proceedings of the16th International Conference on World Wide Web, ser. WWW ’07.New York, NY, USA: ACM, 2007, pp. 639–648. [Online]. Available: http://doi.acm.org/10.1145/1242572.1242659 [13]

REFERENCES [1]

[2] [3]

[4] [5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

Ankit Kumar Jain and B. B. Gupta, “Phishing Detection Analysis of Visual Similarity Based Approaches”, Hindawi 2017.

A. Mishra and B. B. Gupta, “Hybrid Solution to Detect and Filter Zero-day Phishing Attacks”, ERCICA 2014.

Jian Mao, Pei Li, Kun Li, Tao Wei, and Zhenkai Liang, “Bait Alarm Detecting Phishing Sites Using Similarity in Fundamental Visual Features”, INCS 2013.

Eric Medvet, Engin Kirda and Christopher Kruegel, “Visual-Similarity-Based Phishing Detection”, ACM 2015.

Matthew Dunlop, Stephen Groat, and David Shelly, “GoldPhish Using Images for Content-Based Phishing analysis”, IEEE 2010.

Haijun Zhang, Gang Liu, Tommy W. S. Chow, and Wenyin Liu, “Textual and Visual Content-Based Anti-Phishing A Bayesian Approach”, IEEE 2011 Aaron Blum, Brad Wardman, Thamar Solorio, Gary Warner; “Lexical Feature Based Phishing URL Detection Using Online Learning”, Department of Computer and Information Sciences The University of Alabama at Birmingham, Alabama, 2016 Pawan Prakash, Manish Kumar, Ramana Rao Kompella, MinaxiGupta,Purdue University, Indiana University "PhishNet: Predictive Blacklisting to Detect Phishing Attacks".

The Anti-Phishing Working Group, DNS Policy Committee;” Issues in Using DNS Whois Data for Phishing Site Take Down”,The Anti-Phishing Working Group Memorandum, 2011.

Guang Xiang, Jason Hong, Carolyn P. Rose, Lorrie Cranor,”CANTINA+: A Feature- rich Machine Learning Framework for Detecting Phishing Web Sites”, School of Computer Science Carnegie Mellon University, ACM Society of computing Journal 2015.

S. Chiba, K. Sugawara, and T. Watanabe, “Classification and function estimation of protein by using data compression and genetic algorithms,”in Proceedings of the 2001 Congress on Evolutionary Computation (IEEE Cat. No. 01TH8546), vol. 2. IEEE, 2001, pp. 839–844.

D. Fetterly, M. Manasse, and M. Najork, “On the evolution of clustersof near-duplicate web pages,” in Proceedings of the First Conferenceon Latin American Web Congress, ser. LA-WEB ’03. Washington,DC, USA: IEEE Computer Society, 2003, pp.

37–.

[Online].

Available:http://dl.acm.org/citation.cfm?id=951953.95 2397

© 2021, IRJET

|

Impact Factor value: 7.529

|

ISO 9001:2008 Certified Journal

|

Page 982