PhisherHunter: Module design for automatic detection of phishing websites and preventing user abuse

Samet Ganal; Ecir Küçüksille; Mehmet Ali Yalçınkaya

Article Details

PhisherHunter: Module design for automatic detection of phishing websites and preventing user abuse

Authors:

Samet Ganal | Ecir Küçüksille | Mehmet Ali Yalçınkaya

Publisher:

Pamukkale University

Main Topics:

Bilgi Güvenliği Yönetimi

Journal:

Pamukkale Üniversitesi Mühendislik Bilimleri Dergisi Vol.29 Issue 5, pp.468-480

Document Type:

Article

Publication Date:

10/2023

Document Language:

English

Document ID (Org No.):

2001303394

pISSN:

2147-5881

Keywords:

Abstract:

 One of the most common cyber-attacks that users encounter on the internet are phishing websites. In the attacks that are performed on phishing websites, real websites are duplicated and published on different domain names, and users are directed to these fake websites through various social engineering techniques. Through to the website to which users are directed, they transmit some personal and confidential data such as credit card, username-password details to attackers. In this study, the establishment of the infrastructure and content of phishing internet sites has been explained, a tool named PhisherHunter created, and four different methods have been developed so as to detect such websites. Through the examination of newly registered websites, which is the main detection method, a successful detection rate of 95.4 has been achieved. Three different methods have been used in the active defense part of the study. Firstly, the hosting company has been automatically determined to stop the publication of the phishing website and a notification has been sent with a success rate of 98. As the second active defense method, the active honeypot technique has been developed. The active honeypot method aims to enter a marked information on the phishing website and to track this information on the real website. And as the last active defense method, the method of poisoning phishing websites by using fake data has been developed. It has been observed that poisoning methods by using the techniques of active honeypot and fake data have achieved a success of 92.

 One of the most common cyber-attacks that users encounter on the internet are phishing websites. In the attacks that are performed on phishing websites, real websites are duplicated and published on different domain names, and users are directed to these fake websites through various social engineering techniques. Through to the website to which users are directed, they transmit some personal and confidential data such as credit card, username-password details to attackers. In this study, the establishment of the infrastructure and content of phishing internet sites has been explained, a tool named PhisherHunter created, and four different methods have been developed so as to detect such websites. Through the examination of newly registered websites, which is the main detection method, a successful detection rate of 95.4 has been achieved. Three different methods have been used in the active defense part of the study. Firstly, the hosting company has been automatically determined to stop the publication of the phishing website and a notification has been sent with a success rate of 98. As the second active defense method, the active honeypot technique has been developed. The active honeypot method aims to enter a marked information on the phishing website and to track this information on the real website. And as the last active defense method, the method of poisoning phishing websites by using fake data has been developed. It has been observed that poisoning methods by using the techniques of active honeypot and fake data have achieved a success of 92.

 One of the most common cyber-attacks that users encounter on the internet are phishing websites. In the attacks that are performed on phishing websites, real websites are duplicated and published on different domain names, and users are directed to these fake websites through various social engineering techniques. Through to the website to which users are directed, they transmit some personal and confidential data such as credit card, username-password details to attackers. In this study, the establishment of the infrastructure and content of phishing internet sites has been explained, a tool named PhisherHunter created, and four different methods have been developed so as to detect such websites. Through the examination of newly registered websites, which is the main detection method, a successful detection rate of 95.4 has been achieved. Three different methods have been used in the active defense part of the study. Firstly, the hosting company has been automatically determined to stop the publication of the phishing website and a notification has been sent with a success rate of 98. As the second active defense method, the active honeypot technique has been developed. The active honeypot method aims to enter a marked information on the phishing website and to track this information on the real website. And as the last active defense method, the method of poisoning phishing websites by using fake data has been developed. It has been observed that poisoning methods by using the techniques of active honeypot and fake data have achieved a success of 92.

 Günümüz dünyasında bilgisayar ve mobil cihazların kullanımının yaygınlaşması internet kullanımının giderek artmasına neden olmaktadır. Kullanıcıların internet ortamında en çok karşılaştığı siber saldırılardan biri oltalama internet siteleridir. Oltalama internet siteleri üzerinden gerçekleştirilen saldırılarda, gerçek internet siteleri kopyalanıp farklı alan adları üzerinden yayın yapılmakta ve kullanıcılar bu sahte internet sitelerine çeşitli sosyal mühendislik teknikleriyle yönlendirilmektedir. Kullanıcılar yönlendirildikleri internet sitesine göre; kredi kartı, kullanıcı adı-şifre bilgileri gibi kişisel ve gizli verilerini saldırgana iletmiş olmaktadır.Bu çalışmada; oltalama internet sitelerinin altyapısının ve içeriğinin oluşturulması anlatılmış, bu tür internet sitelerini tespit etmede kullanılacak 4 farklı metot geliştirilmiştir. Ana tespit yöntemi olan yeni kayıtlı internet sitelerinin incelenmesi ile beraber 95.4lük başarılı tespit oranına ulaşılmıştır. Çalışmanın aktif savunma kısmında üç farklı yöntem kullanılmıştır. İlk olarak oltalama internet sitesi yayınının durdurulması için yer sağlayıcı firma otomatik olarak tespit edilmiş ve 98 başarı oranıyla bildirim gönderilmiştir. İkinci aktif savunma yöntemi olarak aktif bal küpü honeypot tekniği geliştirilmiştir. Aktif bal küpü yöntemi oltalama internet sitesine işaretli bir bilgi girilmesi ve bu bilginin gerçek internet sitesinde takibini amaçlamaktadır. Bu yöntem ile saldırgana ait pek çok veri elde edilebilmektedir. Son aktif savunma yöntemi olarak, oltalama internet sitelerini sahte veriler ile zehirleme metodu geliştirilmiştir. Bu yöntem ile oltalama internet sitelerinin girdi alanları otomatik tespit edilmekte ve çok fazla sahte veri gönderilerek gerçek kullanıcı bilgilerinin saldırganlar tarafından ayırt edilmesi önlenmeye çalışılmıştır. Aktif bal küpü ve sahte veri ile zehirleme yöntemlerinin 92 başarı elde ettiği görülmüştür.

Article Details

PhisherHunter: Module design for automatic detection of phishing websites and preventing user abuse

Authors:

Samet Ganal | Ecir Küçüksille | Mehmet Ali Yalçınkaya

Publisher:

Pamukkale University

Main Topics:

Bilgi Güvenliği Yönetimi

Journal:

Pamukkale Üniversitesi Mühendislik Bilimleri Dergisi Vol.29 Issue 5, pp.468-480

Document Type:

Article

Publication Date:

10/2023

Document Language:

English

Document ID (Org No.):

2001303394

pISSN:

2147-5881

Phishing

Phishing website

Active defenseOltalama

Oltalama internet sitesi

Aktifsavunma

Issues

Article Details

PhisherHunter: Module design for automatic detection of phishing websites and preventing user abuse

Authors: Samet Ganal | Ecir Küçüksille | Mehmet Ali Yalçınkaya

Publisher: Pamukkale University

Main Topics: Bilgi Güvenliği Yönetimi

Journal: Pamukkale Üniversitesi Mühendislik Bilimleri Dergisi Vol.29 Issue 5, pp.468-480

Document Type: Article

Publication Date: 10/2023

Document Language: English

Document ID (Org No.): 2001303394

pISSN: 2147-5881

Phishing

Phishing website

Active defenseOltalama

Oltalama internet sitesi

Aktifsavunma

Issues

Authors:

Samet Ganal | Ecir Küçüksille | Mehmet Ali Yalçınkaya

Publisher:

Pamukkale University

Main Topics:

Bilgi Güvenliği Yönetimi

Journal:

Pamukkale Üniversitesi Mühendislik Bilimleri Dergisi Vol.29 Issue 5, pp.468-480

Document Type:

Article

Publication Date:

10/2023

Document Language:

English

Document ID (Org No.):

2001303394

pISSN:

2147-5881