Search

Phishing attack is a cybercrime that can lead to severe financial losses for Internet users and entrepreneurs. Typically, phishers are fond of using fuzzy techniques during the creation of a website. They confuse the victim by imitating the appearance and content of a legitimate website. In addition, many websites are vulnerable to phishing attacks, including financial institutions, social networks, e-commerce, and airline websites. This paper is an extension of our previous work that leverages the favicon with Google image search to reveal the identity of a website. Our identity retrieval technique involves an effective mathematical model that can be used to assist in retrieving the right identity from the many entries of the search results. In this paper, we introduced an enhanced version of the favicon-based phishing attack detection with the introduction of the Domain Name Amplification feature and incorporation of addition features. Additional features are very useful when the website being examined does not have a favicon. We have collected a total of 5,000 phishing websites from PhishTank and 5,000 legitimate websites from Alexa to verify the effectiveness of the proposed method. From the experimental results, we achieved a 96.93% true positive rate with only a 4.13% false positive rate.

Phishing, also called brand spoofing, has become the most troubling scam on the Internet, which seriously threatens the Web security. The essence of phish is that "robbers" use false sites, which look like a trustworthy brand site, where favicon, logo and copyright notice are important brand identities. We analyzed 78-day phishing data of PhishTank and Anti-Phishing Working Group APWG. The statistics show that more than 98.93% phishing sites contain at least one brand entity-favicon, logo or copyright notice. Indeed, only a few lowest-quality phishing campaigns do not use such brand elements. Obviously, brand entities are powerful weapons of phishers to trick users. By analyzing the characteristics of brand entities in phishing sites, several brand identity features are extracted. However, only brand entities do not consider whether the Web page with brand entities belongs to the corresponding brand or has an authorization to use the brand entities. To solve this problem, redirection, incoming links and Domain Name System DNS information-based brand authorization features are further extracted to discriminate the sites with branding rights from phishing sites. Based on extracted features, statistical anti-phishing classification models are trained. We collected a diverse spectrum of corpora containing 3863 phishing cases from PhishTank and APWG, and 17571 legitimate samples from DMOZ, Google and DNS resolution log. Experimental evaluations show that the model achieves 98.8% true positive rate and 0.09% false positive rate, which demonstrates the competitive performances of extracted features for statistical anti-phishing in practice. Copyright © 2014 John Wiley & Sons, Ltd.

Web 2.0 and browsers are two very closely connected concepts. The reason is that browsers are the user agents that are needed to make navigating web 2.0 a reality. Within a very short span of time, new versions have been issued by the top three web browsers: Explorer, Firefox and Opera. In this article we examine and compare the new capabilities and functions of these three browsers in terms of the new web.

Currently, no approved standards exist to aid authors in designing usable multimedia documents. Sites exist on the Internet offering style guides which are often very detailed. In most cases, only the most determined of authors will wade their way through such sites for advice. Icon bars contribute a great deal to resolving usability problems. Standard Internet browsers have an icon bar, which this paper refers to as a ‘Site level icon bar’, due to the functions of its buttons—they control functions of the browser which do not belong to the viewed document but rather to the Internet sites visited. This paper argues that major usability problems (i.e. in relation to authoring and navigation of Web documents) can be overcome by introducing another type of icon bars, i.e. a ‘Document level icon bar’—for which the functions are directly relevant to the document being viewed, rather than to the site visited as in the first type. A programmable document level icon bar would enable the authoring of a range of standard navigational buttons which in turn would increase the speed of document transmission. Furthermore, widespread adoption of this icon bar will reduce the total burden on the bandwidth of the Internet as a whole. A prototype tool, called WebCheck, has been developed with a programmable document level icon bar to demonstrate this idea.

Web browsers are essential tools for accessing the internet. Extra complexities are added to forensic investigations when recovering browsing artefacts as portable and private browsing are now common and available in popular web browsers. Browsers claim that whilst operating in private mode, no data is stored on the system. This paper investigates whether the claims of web browsers discretion are true by analysing the remnants of browsing left by the latest versions of Internet Explorer, Chrome, Firefox, and Opera when used in a private browsing session, as a portable browser, and when the former is running in private mode. Some of our key findings show how forensic analysis of the file system recovers evidence from IE while running in private mode whereas other browsers seem to maintain better user privacy. We analyse volatile memory and demonstrate how physical memory by means of dump files, hibernate and page files are the key areas where evidence from all browsers will still be recoverable despite their mode or location they run from.