Cantina: A content-based approach to detecting phishing web sites

16th International World Wide Web Conference, WWW2007

Volumn , Issue , 2007, Pages 639-648

  Zhang, Yue ^a   Hong, Jason I ^b   Cranor, Lorrie F ^b  

^a University of Pittsburgh   (United States)

^b Carnegie Mellon University   (United States)

Author keywords

Anti phishing; Evaluation; Phishing; TF IDF; Toolbar

Indexed keywords

ANTIPHISHING; INFORMATION RETRIEVAL ALGORITHMS;

CONTENT BASED RETRIEVAL; HEURISTIC METHODS; INFORMATION RETRIEVAL; INFORMATION SERVICES; PROBLEM SOLVING; USER INTERFACES;

WEBSITES;

EID: 35348905575     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1242572.1242659     Document Type: Conference Paper

References (41)

1. 3Sharp, 3Sharp Study finds Internet Explorer 7 Edges Out Netcraft As Most Accurate for Anti-Phishing Protection. 2006. http://www.3sharp.com/projects/ antiphishing/
2. Anti-Phishing Working Group, Phishing Activity Trends Report. 2006. http://www.antiphishing.org/reports/apwg_report_june_06.pdf
3. Anti-Phishing Working Group (APWG). Visited: Nov 20, 2006. http://www.antiphishing.org/
4. Chou, N., R. Ledesma, Y. Teraguchi, D. Boneh, and J.C. Mitchell. Client-Side Defense against Web-Based Identity Theft. In Proceedings of The 11th Annual Network and Distributed System Security Symposium (NDSS '04). http://crypto.stanford.edu/SpoofGuard/webspoof.pdf
5. Cloudmark Inc. Visited: Nov 20, 2006. http://www.cloudmark.com/desktop/ download/
6. Cranor, L., S. Egelman, J. Hong, and Y. Zhang. Phinding Phish: Evaluating Anti-Phishing Tools. In Proceedings of The 14th Annual Network and Distributed System Security Symposium (NDSS '07). February 28- March 2, 2007.
7. Dao, T., Term frequency-Inverse document frequency implementation in C#, The Code Project - C# Programming. Visited: Nov 20, 2006. http://www. codeproject.com/csharp/tfidf.asp
8. Dhamija, R. and J.D. Tygar. The battle against phishing: Dynamic Security Skins. In Proceedings of the First Symposium on Usable Privacy and Security (SOUPS 2005). pp. 77-88 2005.
9. Dhamija, R., J.D. Tygar, and M. Hearst. Why Phishing Works. In Proceedings of ACM Conference on Human Factors in Computing Systems (CHI2006), pp. 581-590, April 2006.
10. Downs, J.S., M.B. Holbrook, and L.F. Cranor. Decision strategies and susceptibility to phishing. In Proceedings of the Second Symposium on Usable Privacy and Security (SOUPS 2006). pp. 79-90 2006.
11. eBay Inc., Spoof Email Tutorial. Visited: Nov 20, 2006. http://pages.ebay.com/education/spooftutorial/
12. eBay Inc., Using eBay Toolbar's Account Guard. Visited: Nov 20, 2006. http://pages.ebay.com/help/confidence/account-guard.html
13. Federal Trade Commission, An E-Card for You game. Visited: Nov 20, 2006. http://www.ftc.gov/bcp/conline/ecards/phishing/index.html
14. Federal Trade Commission, Federal Trade Commission. Phishing Alerts. Visited: Nov 20, 2006. http://www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt. htm
15. Ferguson, A.J., Fostering E-Mail Security Awareness: The West Point Carronade, EDUCASE Quarterly, 2005. http://www.educause.edu/ir/library/ pdf/eqm0517.pdf
16. Fette, I., N. Sadeh, and A. Tomasic. Learning to Detect Phishing Emails. ISRI Technical Report. CMU-ISRI-06-112, 2006. http://reports-archive.adm.cs.cmu. edu/anon/isri2006/abstracts/06-112.html
17. Gabber, E., P.B. Gibbons, Y. Matias, and A.J. Mayer. How to make personalized web browsing simple, secure, and anonymous. In Proceedings of Financial Cryptography, pp. 17-32 1997.
18. GeoTrust Inc., TrustWatch Toolbar. Visited: Nov 20, 2006. http://toolbar.trustwatch.com/tour/v3ie/toolbar-v3ie-tour-overview.html
19. Google Inc., Google Safe Browsing for Firefox. Visited: Nov 20, 2006. http://www.google.com/tools/firefox/safebrowsing/
20. Halderman, J.A., B. Waters, and E.W. Felten. A Convenient Method for Securely Managing Passwords. In Proceedings of 14th International World Wide Web Conference, 2005.
21. Herzberg, A. and A. Gbara, TrustBar: Protecting (even Naive) Web Users from Spoofing and Phishing Attacks. 2004, Cryptology ePrint Archive: Report 2004/155. http://www.cs.biu.ac.il/~herzbea/Papers/ecommerce/spoofing.htm
22. Jackson, J.W., A.J. Ferguson, and M.J. Cobb. Building a University-wide Automated Information Assurance Awareness Exercise: The West Point Carronade. In Proceedings of 35th ASEF/IEEE Frontiers in Education Conference 2005. http://fie.engrng.pitt.edu/fie2005/papers/1694.pdf
23. Jagatic, T., N. Johnson, M. Jakobsson, and F. Menczer, Social Phishing, 2006, http://www.indiana.edu/~phishing/social-network-experiment/phishing- preprint.pdf
24. Keizer, G., Phishing Costs Nearly $1 Billion, TechWeb Technology News. Visited: Nov 20, 2006. http://www.techweb.com/wire/ security/164902671
25. Kumaraguru, P., Y.W. Rhee, A. Acquisti, L. Cranor, and J. Hong. Protecting People from Phishing: The Design and Evaluation of an Embedded. Training Email System. In Proceedings of CHI2007.
26. Mail Frontier, Phishing IQ. Visited: Nov 20, 2006. http://survey. mailfrontier.com/survey/quiztest.html
27. McMillan, R., Gartner: Consumers to lose $2.8 billion to phishers in 2006, NetworkWorid, 2006. http://www.network.world.com/news/2006/ 110906-gartner-consumers-to-lose-28b.html
28. Microsoft, Consumer Awareness Page on Phishing. Visited: Nov 20, 2006. http://www.microsoft.com/athome/security/email/phishing.mspx
29. Netcraft, Netcraft Anti-Phishing Toolbar. Visited: Nov 20, 2006. http://toolbar.netcraft.com/
30. New York State Office of Cyber Security & Critical Infrastructure Coordination. 2005. Gone Phishing... A Briefing on the Anti-Phishing Exercise Initiative for New York State Government. Aggregate Exercise Results for public release.
31. Panahy, A., Google Parser, The Code Project - C# Programming. Visited: Nov 20, 2006. http://www.codeproject.com/csharp/googleparser.asp
32. Phelps, T.A. and R. Wilensky, Robust Hyperlinks and Locations, D-Lib Magazine, vol. 6(7/8), 2000. http://www.dlib.org/dlib/july00/wilensky/ 07wilensky.html
33. PhishTank. Visited: Nov 20, 2006. http://www.phishtank.com/
34. PhishTank, Statistics about Phishing Activity and PhishTank Usage. Visited: Nov 20, 2006. http://www.phishtank.com/stats/2006/10/
35. Salton, G. and M.J. McGill, Introduction to Modern Information Retrieval. New York, NY: McGraw-Hill, 1986.
36. Stanford Applied Crypto Group, PwdHash. Visited: Nov 20, 2006. http://crypto.stanford.edu/PwdHash
37. Wu, M., R. Miller, and S. Garfinkel. Do Security Toolbars Actually Prevent Phishing Attacks? In Proceedings of ACM Conference on Human Factors in Computing Systems (CHI2006), CHI Letters 8(1). Quebec, Canada: ACM Press. pp. 601-610, April 2006.
38. Wu, M., R.C. Miller, and G. Little. Web Wallet: Preventing Phishing Attacks by Revealing User Intentions. In Proceedings of The Second Symposium on Usable Privacy and Security (SOUPS 2006). pp. 102-113 2006.
39. Ye, Z., S. Smith, and D. Anthony, Trusted paths for browsers. ACM Transactions on Information and System Security 2005. 8(2): p. 153-186.
40. Yee, K.-P. and K. Sitaker. Passpet: Convenient Password Management and Phishing Protection. In Proceedings of The Second Symposium on Usable Privacy and Security (SOUPS 2006). pp. 32-43 2006.
41. Zolnikov, P., Extending Explorer with Band. Objects using.NET and Windows Forms, The Code Project - C# Programming. Visited: Nov 20, 2006. http://www.codeproject.com/csharp/dotnetband.objects.asp