Search

Although in recent years a variety of anti-phishing studies have been carried out, phishing fraud has become increasingly rampant. Especially with the popularity of electronic banking and mobile payment, phishing attacks have become more profitable. In this context, exploring efficient and practical anti-phishing technology is particularly necessary and urgent. In this paper, by analyzing the resources (CSS, JS, and image files) request characteristics of phishing sites, we propose a novel anti-phishing method — RRPhish. RRPhish as an enhanced blacklist technology, can detect not only phishes in blacklist, but also emerging phishes. The experiments demonstrate the effectiveness of RRPhish.

Although the current Domain Name System (DNS) is already mature enough and widely used, there are still some fundamental problems for the future Internet and Internet of Things (IoT). Aiming at altering the centralized domain name management model in DNS, we propose a decentralized and distributed domain name system based on Blockchain, which is named as DNSLedger. DNSLedger implements the features of common maintenance, node equivalence and so on. This paper will make a brief introduction of DNSLedger and analyze what advantages the proposed model has.

JavaScript can modify HyperText Markup Language(HTML) code. tag of HTML can load pages from other websites. These technologies are widely used nowadays for constructing flexible and robust web services. However, illegal websites also use these technologies to hide illegal contents. For traditional methods using web text to detect these illegal webpages (just getting initial source codes that aren't parsed by a browser), they can't give a precise judgment. In this paper, we solved the challenge and proposed a robust Internet abuse detection method. We get HTML codes that had been parsed by simulating the progress how browsers work in order to gather the necessary materials for text detection methods. Besides, we not only extracted the text features of HTML code, but also extracted structure features of HTML codes. With the experiments under detecting Internet abuse scenarios, we demonstrated that the proposal is efficient.

Phishing is increasingly severe in recent years, which seriously threatens the privacy and property security of netizens. Phishing is essentially a counterfeiting of brands. In order to effectively cheat the victim, phishing sites are visually and semantically highly similar to real sites. In recent years, anti-phishing methods based on machine learning are mainstream anti-phishing methods. The effectiveness of the machine learning models hinges on the extracted statistical features. However, the extracted statistical features mainly focus on visual similarity, stealing information and third-party services, which ignore the semantic information of web pages. Therefore, we extract a series of semantic features through word2vec to better describe the features of phishing sites, and further fuse them with other multi-scale statistical features to construct a more robust phishing detection model. The experimental results on the actual data sets show that the majority of phishing websites are effectively identified by only mining the semantic features of word embeddings. The phishing detection models based on fusion features obtained the best detection results, which shows that semantic features and other statistical features have good complementarity. The proposed method provides a promising way for phishing detection in actual Internet environment, which boosts the phishing detection performance effectively.

With the development of wireless communication technologies, the mobile terminal can be installed with more than one wireless interfaces to support its flexible roaming and vertical handover between heterogeneous access networks. Traditionally, the ongoing session has to be re-established when the multi-interface terminal hands over vertically while maintaining the Delay Tolerant Networking (DTN) communication. In this paper, a novel solution is proposed to efficiently support the on-demand DTN communication under the heterogeneous access networks based on Named Data Networking (NDN) architecture.

Serving as the global Internet's phonebook, the Domain Name Service (DNS) helps to translate human-friendly domain names into machine-readable IP addresses, which makes DNS of great importance to the operation of the Internet and virtually relied on by today's almost all kinds of Internet-based activities. As such, people whoever want to go anywhere over the Internet will need to refer to the DNS first. Therefore, it has become an ideal way to conduct online privacy exploitations through the DNS due to people's pervasive usage of the Internet. However, the current DNS doesn't provide any countermeasure against this kind of exploitation, and thus risks severe privacy disclosure problems. In this paper, we give a comprehensive empirical analysis of DNS privacy disclosure problems by exploring potential privacy leaking paths in the DNS. Then we further identify and describe multiple criterions of validity systematically that are obligated when considering DNS privacy preservation. Finally, we propose a simple DNS privacy preserving solution with significant deployment potential in the current DNS, which can only lead to a moderate level of extra query latency perceived by end users.

Phishing is a security attack that involves the creation of websites that mimic legitimate websites, and these fraud websites bring Internet users a lot of loss. Traditional anti-phishing methods usually worked in a passive way by receiving report data of user. Due to the growing shorter survival time of phishing, this kind of methods is not efficient enough to find and take down new phishing attacks. In this paper, we propose an Intelligent Phishing Detection (IPD) system to address phishing detection problem actively. Specially, IPD first generates the detection dataset from the global massive domain name registration data automatically; then it applies the Naive Bayes algorithm which is optimized by position-based features to achieve the high precision detection; finally, in order to find more phishing websites, IPD expands detection dataset by generating Uniform Resource Locator (URL) templates based on the detection results. The experimental results of IPD demonstrate the effectiveness and timeliness in detection phishing websites.

Phishing is a type of scam designed to steal user's identity. Typically, anti-phishing methods either use blacklists or recognize the phishing pattern with statistical learning. This paper focuses on a tiny but powerful visual element-favicon, which is widely used by phishers but ignored by anti-phishing researchers. Indeed, only some lowest-quality phishing campaigns do not use such favicons. By analyzing the characteristic of favicon in phishing sites, an alternative phishing detection method is proposed. Favicon detection and recognition locates the suspicious brand sites, including legitimate and fake brands sites, and then PageRank and DNS filtering algorithm discriminates the sites with branding rights from fake brands sites. To validate the effectiveness of the proposed method, we carried out two different experiments. One is collecting a diverse spectrum of corpora containing 3642 phishing cases containing favicons from PhishTank, and 19585 legitimate Web pages from DMOZ and Google; experimental evaluations on the data set show that the proposed method achieved over 99.50% TPR and 0.15% FPR. The other is validating the method in the real Web query environment; a total of 517 unique phishing URLs were found and reported to the Anti-Phishing Alliance of China in a month. The experimental results demonstrate the competitive performances of favicon detection and recognition method for anti-phishing in practice.

Traditional Web spam classifiers use only labeled data (feature/label pairs) to train. Labeled spam instances, however, are very difficult, expensive, or time consuming to obtain, as they require the efforts of experienced human annotators. Meanwhile unlabeled samples are relatively easy to collect. Semi-supervised learning addresses the classification problem by using large amount of unlabeled data, together with the labeled data, to build better classifiers. This paper proposes two new semi-supervised learning algorithms to boost the performance of Web spam classifiers. The algorithms integrate the traditional co-training with the topological dependency based hyperlink learning. The proposed methods extend our previous work on self-training based semi-supervised Web spam detection. The experimental results with 100/200 labeled samples on the standard WEBSPAM-UK2006 benchmark showed that the algorithms are effective.

The algorithms on learning to rank can traditionally be categorized as three classes including point-wise, pair-wise and list-wise. In our work, we focus on the regression-based method for the multi-partite ranking problems due to the efficiency of the point-wise methods. We proposed two ranking algorithms with the real AdaBoost and the discrete AdaBoost, which compute the expectation of the ratings with the estimation of the pseudo posterior probabilities. We found that it can be explained in the framework of the regression with the squared loss. It is more easily implemented than the previous McRank method since the algorithm adopts the decision stump as the weak leaner instead of the regression tree. In the fifteen benchmark datasets, our methods achieve better performance than the pair-wise method RankBoost under the C-index, NDCG and variant of NDCG measures. It has the lower training time complexity than RankBoost but the identical test time complexity.

Anti-spam has become one of the top challenges for the Web search. In this paper, we explore the Web spam detection as a binary classification problem. Based on the fact that reputable pages are more easy to be obtained than spam ones on the Web, an ensemble under-sampling classification strategy is adopted, which exploits the information involved in the large number of reputable Websites to full advantage. The strategy is based on the predicted spamicity of every sub-classifiers, in which both content-based and link-based features are taken into account. The experiments on standard WEBSPAM-UK2006 benchmark showed that the ensemble strategy can improve the web spam detection performance effectively.