PhishTester: Automatic testing of phishing attacks

SSIRI 2010 - 4th IEEE International Conference on Secure Software Integration and Reliability Improvement

Volumn , Issue , 2010, Pages 198-207

  Shahriar, Hossain ^a   Zulkernine, Mohammad ^a  

^a QUEEN S UNIVERSITY   (Canada)

Author keywords

Application behavior model; Cross site scripting; Finite state machine; Heuristic coveage; Phishing

Indexed keywords

ANTI-PHISHING; BEHAVIOR MODEL; COVERAGE CRITERIA; CROSS SITE SCRIPTING; FALSE NEGATIVES; FALSE POSITIVE; FINITE STATE MACHINES; PERSONAL INFORMATION; PHISHING; PHISHING ATTACKS; REAL APPLICATIONS; TESTING PROCESS; WEB APPLICATION; WEB APPLICATION TESTING; WEB-BASED ATTACKS;

AUTOMATIC TESTING; CONTOUR FOLLOWERS; INFORMATION DISSEMINATION; SOFTWARE RELIABILITY; WORLD WIDE WEB;

SECURITY OF DATA;

EID: 77954841986     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SSIRI.2010.17     Document Type: Conference Paper

References (38)

1. rd International Conference on Security and Privacy in Communication Networks, Nice, France, Sept 2007, pp. 454-463.
2. nd Annual Computer Security Applications Conference, Miami, Florida, December 2006, pp. 381-392.
3. th Annual International Computer Software and Applications Conference, July 2005, Edinburgh, Scotland, pp. 517-524.
4. th Hawaii International Conference on System Sciences, Hawaii, USA, January 2007, pp. 270c-270c
5. X. Dong, J. A Clark, and J. Jacob, "User Behavior-based Phishing Websites Detection," Proc. of International Multiconference on Computer Science and Information Technology, Wisla, Poland, October 2008, pp. 783-790.
6. Credit Card Number Generator - Test Data Generation, http://sqa. fyicenter.com/Online-Test-Tools/--Test-Credit-Card-Number-Generator.php
7. th Intl. Conf. on World Wide Web, Banff, Alberta, May 2007, pp. 639-648.
8. th Annual Network and Distributed System Security Symposium (NDSS '04), San Diego, CA, February 2004.
9. th International Conference on Knowledge Discovery and Data Mining, Paris, France, pp. 1245-1254.
10. B. Wardman and G. Warner, "Automating Phishing Website Identification through Deep MD5 Matching," eCrime Researchers Summit, Atlanta, USA, October 2008, pp. 1-7.
11. M. Chandrasekaran, R. Chinchani, and S. Upadhyaya, "PHONEY: Mimicking User Response to Detect Phishing Attacks," Proc. of Intl. Symposium on World of Wireless, Mobile and Multimedia Networks, 2006, Niagara-Falls, NY, June 2006, pp. 668-672.
12. C. Yue and H. Wang, "Anti-Phishing in Offense and Defense," Proc. of the Annual Computer Security Applications Conference (ACSAC), Anaheim, California, December 2008, pp. 345-354
13. L. Wenyin, N. Fang, X. Quan, B. Qiu, and G. Liu, "Discovering Phishing Target based on Semantic Link Network," Future Generation Computer Systems, Elsevier, Volume 26, Issue 3, March 2010, pp. 381-388.
14. nd International Conference on Internet Multimedia Services Architecture and Applications, Bangalore, India, December 2008, pp. 1-6.
15. W. Liu, G. Huang, G. Huang, and A. Fu, "An Antiphishing Strategy Based on Visual Similarity Assessment," IEEE Internet Computing, Volume 10, Issue 2, March 2006, pp. 58-65.
16. G. Zuchlinski, The Anatomy of Cross Site Scripting, November 2003.
17. th Intl. Conf. on World Wide Web, Banff, Alberta, Canada, May 2007, pp. 649-656.
18. th International Conference on World Wide Web, Madrid, Spain, April 2009, pp. 571-580.
19. A. Andrews, J. Offutt, and R. Alexander, "Testing Web Applications by Modeling with FSMs," Journal of Software and System Modeling, 4(2):326-345.
20. rd International Conference on Software Engineering, Toronto, Canada, May 2001, pp. 25-34.
21. Y. Wang, R. Agrawal, and B. Choi, "Light Weight Anti-Phishing with User Whitelisting in a Web Browser," Proc. of the IEEE Region 5 Conference, Kansas City, April 2008, pp. 1-4.
22. J. Kang and D. Lee, "Advanced White List Approach for Preventing Access to Phishing Sites," Proc. of the Intl. Conf. on Convergence Information Technology, Korea, November 2007, pp. 491-496.
23. M. sharifi and S. Siadati, "A Phishing Sites Blacklist Generator," Proceedings of International Conference on Computer Systems and Applications (AICCSA), Doha, Qatar, April 2008, pp. 840-843.
24. R. Dhamija and J. Tygar, "The battle against phishing: Dynamic Security Skins," Proc. of the Symposium on Usable Privacy and Security, Pittsburgh, USA, July 2005, pp. 77-88.
25. th Conf. on Email and Anti-Spam, July 2009, California, USA.
26. M. Wu, R. Miller, and G. Little, "Web Wallet: Preventing Phishing Attacks by Revealing User Intentions," Proc. of the Symp. On Usable Privacy and Security, July 2006, Pennsylvania, pp. 102-113.
27. Jericho HTML Parser, Accessed from http://jericho.htmlparser.net
28. D. Geer, "Security Technologies go Phishing," Computer Archive, Volume 38, Issue 6, June 2005, pp. 18-21.
29. T. Beardsley, Evolution of Phishing Attacks, January 2005, Accessed from www.antiphishing.org/Evolution of Phishing Attacks.pdf
30. rd Anti-Phishing Working Group eCrime Researchers Summit, October 2008, Atlanta, Georgia, pp. 1-10.
31. Nexus, Applying XSS to Phishing Attacks, April 2007, http://nexus. playhack.net
32. PhishTank, Access form phishtank.org
33. B. Song, H. Miao, and S. Chen, "Modeling Web Browser Interactions and Generating Tests," Proc. of the Intl. Conf. on Computational Intelligence and Security, Suzhou, China, Dec. 2008, pp. 399-404.
34. th Intl. Conference on Model Driven Engineering Languages and Systems, Nashville, USA, September 2007, pp. 346-359.
35. th International Computer Software and Applications Conference, Oct 2000, Taipei, Taiwan, pp. 41-47.
36. M. Fantinato and M. Jino, "Applying Extended Finite State Machines in Software Testing of Interactive Systems," Lecture Notes in Computer Science 2844, pp. 34-45, 2003.
37. th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Switzerland, pp 20-39, 2007.
38. th Annual Network and Distributed System Security Symposium, San Diego, Feb 2007.