System and method to provide automatic classification of phishing sites
A phishing classification model that detects a phishing website based on one or more feature vectors for the website is provided. The phishing classification model may operate on a server and may further select a website, generate a feature vector for a landing page of the website, create a feature vector for every iframe that is a descendent of the landing page, and derive a final feature vector from the feature vectors of the landing page and the descendent iframe pages. Further, machine learning techniques may be applied to generate, or train, a classification model based upon one or more known phishing websites. Based on the feature vector, the classification modeler may classify a website as either a phishing website or as a non-phishing website. Feedback in the form of human verification may further be incorporated.
1. A computer-implemented method comprising:
using a device, creating one or more feature vectors for a landing page of a website, wherein the one or more feature vectors for the landing page are derived from one or more landing page elements;
creating one or more feature vectors for one or more child pages that are a descendant of the landing page;
deriving a final feature vector from the one or more feature vectors of the landing page and the one or more feature vectors for the child pages; and
providing the final feature vector to a model to determine whether the website is a phishing website.
2. The method of claim 1 , further comprising:
inputting the final feature vector into a model, wherein the model outputs a score associated with a probability of being a phishing site given the input; and
classifying the website as a phishing website based on the determined score.
3. The method of claim 2 , further comprising:
classifying the website as a phishing website given the score and a threshold.
4. The method of claim 2 , wherein the final feature vector includes
a concatenation of at least some of the following individual feature vectors:
a uniform resource locator (URL) feature vector including at least some of a URL string character n-gram, an IP address character n-gram, and URL geo-location information;
an average URL feature vector derived from links and hrefs on page;
average URL feature vectors derived from links and hrefs on page in bins of similarity to the page URL feature vector;
an html content feature vector;
a classification service classification result feature vector; and
a feature vector based on age of webpage.
5. The method of claim 2 , wherein the model utilizes active learning to compute a priority in which the feature vector should be labeled.
6. The method of claim 2 , wherein the model utilizes one or more labels to identify whether the website is a phishing website or not a phishing website.
7. The method of claim 2 , wherein the model utilizes transductive learning.
8. The method of claim 2 , further comprising:
an output score indicating an entity that is targeted by the phishing website.
9. The method of claim 1 , wherein the feature vector is derived according to the following formula:
p
⇀
=
(
p
⇀
00
,
1
n
1
∑
k
n
1
p
⇀
1
k
,
1
n
11
∑
{
k
❘
k
∈
bin
11
}
n
11
p
⇀
1
k
,
…
,
1
n
1
m
∑
{
k
❘
k
∈
bin
1
m
n
1
m
p
⇀
1
k
,
⋮
,
1
n
l
∑
k
n
l
p
⇀
lk
,
1
n
l
1
∑
{
k
❘
k
∈
bin
l
1
n
l
1
p
⇀
lk
,
…
,
1
n
lm
∑
{
k
❘
k
∈
bin
lm
n
lm
p
⇀
lk
)
.
10. The method of claim 1 , further comprising:
updating one or more classifiers based upon the final feature vector.
11. The method of claim 1 , further comprising:
receiving input from a researcher indicating that the final feature vector should be classified as a phishing website.
12. The method of claim 1 , wherein the one or more child pages are iframe pages.
13. A system for classifying one or more websites as a phishing website, the system comprising:
a plurality of sensors for providing input data to a server configured to:
create one or more feature vectors for a landing page of a website, wherein the one or more feature vectors for the landing page are derived from one or more landing page elements;
create one or more feature vectors for one or more child pages that are a descendant of the landing page;
derive a final feature vector from the one or more feature vectors of the landing page and the one or more feature vectors for the child pages; and
provide the final feature vector to a model to determine whether the website is a phishing website.
14. The system of claim 13 , wherein the server is further configured to input the final feature vector to a model, wherein the model outputs a score associated with a probability of being a phishing site given the input, and classifies the website as a phishing website based on the determined score.
15. The system of claim 13 , wherein the page feature vectors include a concatenation of at least some of the following individual feature vectors:
a uniform resource locator (URL) feature vector including at least some of a URL string character n-gram, an IP address character n-gram, and URL geo-location information;
an average URL feature vector derived from links and hrefs on page;
average URL feature vectors derived from links and hrefs on page in bins of similarity to the page URL feature vector;
an html content feature vector:
a classification service classification result feature vector; and
a feature vector based on age of webpage.
16. The system of claim 13 , wherein the server is further configured to update one or more classifiers based upon the final feature vector.
17. The system of claim 13 , wherein the server is further configured to receive input from a researcher indicating that the final feature vector should be classified as a phishing website.
18. The system of claim 13 , wherein the one or more child pages are iframe pages.
19. A non-transitory computer-readable medium comprising processor-executable instructions that are executable by a processor to facilitate the classification of one or more websites, the instructions comprising:
creating one or more feature vectors for a landing page of a website, wherein the one or more feature vectors for the landing page are derived from one or more landing page elements;
creating one or more feature vectors for one or more child pages that are a descendant of the landing page;
deriving a final feature vector from the one or more feature vectors of the landing page and the one or more feature vectors for the child pages; and
providing the final feature vector to a model to determine whether the website is a phishing website.
20. The non-transitory computer readable medium of claim 19 , wherein the one or more child pages are iframe pages.