BaitAlarm: Detecting Phishing Sites Using Similarity in Fundamental Visual Features

• Published in: 2013 5th International Conference on Intelligent Networking and Collaborative Systems pp. 790 - 795
• Main Authors: Jian Mao, Pei Li, Kun Li, Tao Wei, Zhenkai Liang
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.09.2013
• Subjects: Antiphishing; Browsers; Cascading style sheets; CSS; Feature extraction; Layout; Visualization; Web pages; Web Security
• DOI: 10.1109/INCoS.2013.151

In this paper, we present a new solution, BaitAlarm, to detect phishing attack using features that are hard to evade. The intuition of our approach is that phishing pages need to preserve the visual appearance the target pages. We present an algorithm to quantify the suspicious ratings of web pages based on similarity of visual appearance between the web pages. Since CSS is the standard technique to specify page layout, our solution uses the CSS as the basis for detecting visual similarities among web pages. We prototyped our approach as a Google Chrome extension and used it to rate the suspiciousness of web pages. The prototype shows the correctness and accuracy of our approach with a relatively low performance overhead.