Heuristic Phishing Detection and URL Checking Methodology Based on

Scraping and Web Crawling

Rômulo Almeida* Carla Westphall**
PPGCC-UFSC - Federal University of Santa PPGCC-UFSC - Federal University of Santa
Catarina Catarina
Florianópolis, Santa Catarina Florianópolis, Santa Catarina
[Link]@[Link] [Link]@[Link]

Abstract— With the improvement of techniques used by the latest information on COVID-19. Malicious agents are also
attackers, the detection and prevention of threats such as using names related to coronavirus and government entities
phishing and malware can represent a problem and computa- in the titles of malicious files, in an attempt to trick users
tional challenge. Recent research has found that phishing and
malicious code infection are the main threats triggered by social into opening them. These files are infected with malicious
engineering. In this work, the attack vectors that cause these applications like ransomware and keyloggers [5].
threats are analyzed, proposing a method of checking specific Observing these factors, it is inevitable to have a mini-
strings in URLs and e-mail messages, which can be used in mum security method in a computational environment. To
conjunction with proxies and Anti Spam filters. The method promote such a level of protection, the most diverse security
was implemented in an experimental scenario and is capable
of detecting the presence of the main elements that have direct mechanisms are developed and used. However, even with all
contact with the user, such as: form fields, redirection of links these developments, they still do not have significant results
and downloadable files. Furthermore, the proposed method was in terms of protection of the human factor [6]. From this
able to detect phishing URLs with accuracy values between analysis, the human gap can be seen as the primary breach of
73.3% and 97.66% with an average time of 30 seconds. computational security. Forging trustworthiness in phishing
maneuvers represent the most efficient way to perform a
I. INTRODUCTION
malicious action. This factor highlights the hypothesis that
The digital medium has become essential for the exchange the detection of fake pages is the best strategy to combat
of information and data traffic, has brought flexibility and phishing; it is essential to find a solution that can efficiently
ease in accessing information and, in parallel to this evo- detect these pages [7].
lution, the increase in the number of users, resulting in the Currently, several types of research investigate anti-
exponential growth of digital crimes [1]. It is worth highlight- phishing techniques, and we can divide the techniques used
ing the atypical period that the world is going through with in two categories: list-based techniques and heuristic tech-
the COVID-19 pandemic, where cybercriminals are taking niques [8]. The proposal for analyzing URLs and e-mail
maximum advantage to reach the most significant number of messages presented in this work uses both list-based and
users. Malicious activities increased dramatically due to the heuristic techniques. The methodology used contributes to
side effects of the home office, due to the social distance the detection and extraction of elements characteristic of
measures needed to face the pandemic, causing a higher phishing and can be incorporated into commonly found
number of information security incidents. Cybersecurity’s security scenarios.
importance goes beyond the individual concern of each user; The structure of this work is organized into six sections.
it must be part of each process in organizational settings and Section 2 contains some basic concepts on the topics inves-
can be seen as a growing issue of public concern. tigated, along with the works related to this research. Then,
The last few years have been marked by several incidents. section 3 describes in detail the proposed methodology and
These incidents are responsible for an approximate loss of 42 its implementation in an experimental scenario. Section 4
billion dollars a year, reaching up to 100 billion accounting presents the results obtained in this investigation. Finally,
for unreported cases [2]. The survey of [2] describes that of section 5 presents the final considerations of this work and
the more than five thousand correspondent companies, 47% directions for future works.
experienced fraud or security incidents in the last 24 months.
Threats such as phishing and infection by malware rep- II. RELATED WORKS
resent the main maneuvers of social engineering to reach In the literature, phishing can be defined by creating fake
users [3]. In the vast majority of cases, the individual web pages, where criminals send large volumes of emails
is not aware of how to react to these threats. Phishing with links to these pages. In these messages, malicious agents
attacks are commonly characterized by the sending of e- pretend to be other legitimate individuals or organizations, to
mails and malicious pages by criminals, containing legitimate trick users into providing confidential data. According to [9],
information, inducing victims to provide confidential data phishing attacks can also be classified into spear phishing,
such as passwords and credit card data [4], or even the whaling phishing, and corporate email compromise phishing.

Authorized licensed use limited to: Tsinghua University. Downloaded on December 19,2020 at 02:03:34 UTC from IEEE Xplore. Restrictions apply.
 Spear phishing attacks refer to maneuvers targeting spe- within the source code of the page as hyperlinks to assist
cific individuals or groups, using their names to make in detecting phishing characteristics, increasing the accuracy
false claims or communications. These maneuvers require of the method. The work presents a good accuracy in the
the collection of online information about the victim using detection, but it did not present a mechanism to mitigate
social engineering techniques and digital espionage. This malicious actions.
information is usually collected through scans on social The work [10] presents Phishing-Detective, a heuristic
networks but can also be performed using software such structure for detecting phishing based on a Web Crawler
as SET (Social Engineering Toolkit) on Kali Linux [9]. that extracts information from pages using scraping tech-
Whaling phishing is also a spear-phishing, but it also targets niques. The extracted data is analyzed by a data mining
individuals in high positions in companies. Finally, corporate tool (RapidMiner) to find patterns and report findings. The
email compromise phishing is similar to whaling phishing proposed structure made use of the Scraping technique as
with the difference that its ultimate purpose is to gain access in this work. However, it used a base (PhishMonger) that is
to the mailbox and other private information. In this type of outdated for reproducing the methods nowadays, in addition
attack, social engineering techniques are combined with the to not showing significant results in the detection of URLs
spread of malware by sending attachments containing trojans, or the approximate time to perform the checks.
keyloggers, and other malware. By mapping these vectors, [11] describes an extension of the previous 2015 work
we can detect the key points that need to be checked in URLs where logo images were used to determine the consistency
and e-mail messages to recognize phishing maneuvers. These of the URLs’ identity, the actual and the portrayed identity.
vectors represent patterns already known in malicious URLs Meters determine a consistent identity as a legitimate page
that can be recognized through the collection of WEB data and an inconsistent one as a phishing page. Part of the
(scraping). The scraping technique allows data extraction detection carried out is done through machine learning, based
from pages in search of specific characteristics and can assist on the extracted logo image. Finally, a comparison between
in validating URLs’ legitimacy and in detecting phishing the domain name returned by Google and the name of the
vectors [10]. Similarly, searches for specific strings can be consulted URL allows us to differentiate phishing from a
performed in e-mail messages to obtain the same patterns legitimate page.
checked in the URLs. In [12], a real-time anti-phishing system is proposed,
Phishing detection techniques can be classified into two which uses different classification algorithms and resources
groups: based on lists or heuristic techniques. List-based based on natural language processing (NLP). The system has
techniques can use a resource base based on permissive list- remarkable properties such as language independence, real-
ings (whitelists) or restrictive listings (blacklists). Heuristic time execution, and independence from third-party services.
techniques extract the characteristic properties of existing The Random Forest algorithm is used in the elaboration of
phishing pages to detect new fraudulent pages. The main classifiers and resources, reaching an accuracy of 97.98 %
advantage of heuristic techniques is that they can detect in detecting phishing URLs.
newly created or unknown (zero-day) phishing attacks, and According to [13], the authors propose PhishKiller, a tool
list-based techniques cannot [8]. for detecting and mitigating phishing pages. The tool receives
In [8], the work proposes Jail-Phish, which uses mecha- the addresses accessed by users through the redirection made
nisms capable of detecting phishing URLs hosted on com- by the proxy and uses concepts of Deep Learning to classify
promised servers (PSHCS) and legitimate websites recently the URLs received. According to the results presented, the
registered. The structure compares the suspect page and the methods achieved an accuracy of 98.3 % in the detection of
corresponding domain in the search results to calculate the malicious addresses.
similarity score between them, highlighting the difference In [14], the authors propose PhishMonger, a URL ver-
between PSHCS pages and legitimate pages as high. The ification API, in sync with the PhishTank platform. The
work uses search engines in URLs in real-time, as in this API is responsible for synchronizing with Phishtank and
article, but it does not present effective mechanisms to downloading files from the suspicious page to the last depth
mitigate attacks. Another point of divergence is that this level. This approach can present a high computational cost in
research does not focus on the detection of PSHCS; our work more complex sites or significant variation in the file format.
proposes ways to detect phishing vectors regardless of where Contrary to what is proposed by the authors, in this research,
the pages are hosted. The work showed an accuracy of 98.61 specific searches for Phishing elements will be carried out
% and made use of a hybrid methodology, mixing lists and through Web Crawling, avoiding the reading of trivial data
heuristic techniques. in Phishing detection.
According to [7], the most common way to run phish- Finally, in [15], malicious emails are collected through
ing attacks is to send thousands of fake emails to users, active honeypots. For the detection of phishing messages and
prioritizing a large number of short URLs online. The differentiation of spam messages, the Naive Bayes classifier
work proposes a phishing search engine that performs two is used, with a 92 % hit rate. To extract phishing URLs,
authentications at different levels before declaring a page as heuristic techniques for searching for specific characters in
fake. Queries perform searches for the title along with the their bodies are used. If any of the characters searched for
page’s domain. The authentication processes observe values is found, the URL will be kept in the analysis group.

Authorized licensed use limited to: Tsinghua University. Downloaded on December 19,2020 at 02:03:34 UTC from IEEE Xplore. Restrictions apply.
 III. P ROPOSED M ETHODOLOGY a NoSQL database (MongoDB). The three tools were con-
In this section, the implementation in an experimental figured on separate virtual machines on a Ubuntu operating
scenario of the methodology proposed in this research will system. The machines were implemented in a laboratory en-
be demonstrated. The methodology has the main objective vironment, with 200 users authenticated via LDAP protocol.
of checking URLs and e-mail messages for standard features Users’ WEB traffic is directed to the proxy, and their email
in phishing scams and malicious code infection attempts. boxes monitored by Anti-Spam, as shown in Figure 1.
For that, string search engines have used that look for these The firewall and Anti Spam log files are output in txt
characteristics, such as the extraction API proposed in this format and have been configured to be filled in time real for
work. The API is developed based on concepts related to monitored users. It is worth mentioning that this scenario’s
state of the art and has the principle of scraping technique, choice aims to maintain the maximum approximation with
playing the role of a Web Crawler since it acts as an the structural reality commonly found in corporations with
algorithm that analyzes the code of websites. The algorithm essential security criteria. Initially, for the creation and
behind the application is also able to scan text files for population of the NoSQL database, importing the PhishTank
strings that can indicate URLs, domains, or attached files. Database in csv format is used (Figure 1). The choice of
The extracted elements will be stored in collections. These the Phishtank base among other platforms was made due to
represent structures that will contain important information the availability of access to the platform’s records and the
about the results obtained by the search engines. possibility of connection through its API to carry out queries
Another contribution of this work is that it is even using to the base.
a Dataset imported from another database. The API is still
B. Collections
able to perform new tests on the URLs already obtained and
on the new ones, reducing false positives to the maximum. This work proposes the use of three collections, which
This type of action allows the detection of zero-day phishing represent abstractions of the elements analyzed by the search
URLs, as each URL captured at the moment it is accessed engines: url-database, url-scrapy, mail-database. Figure 2
by the user, a comparison is made to find out if it has shows the organization of the collections used and their
already gone through the Web Crawler check. Through this fields, for a better visualization of the structure.
methodology, it is possible to analyze which malicious URLs
are going unnoticed by the reporting platforms, which types
of phishing are occurring the most for a given group, and
which themes are being used most in the composition of the
fake pages.
A. Experimental Scenario and Samples

Fig. 2. Database Collections

The url-database collection is responsible for storing

information about URLs, taken directly from the PhishTank
base. The collection fields maintain the basic structure im-
ported from the Phistank database, preserving the charac-
teristics of the import URLs such as: phish_id, address,
submission date, verification and URL status. The fields
verified, verification_time and online are important for the
comparative analyzes carried out in this work because they
will allow to infer if a page was detected as phishing and
how long it was active. The verified field represents whether
the URL has been verified as phishing by the community,
and can obtain the values YES or NO. In addition, the
verification_time field represents the date the verification
was made and the phishing was considered valid by the
community. The online field shows the status of the analyzed
URL, whether it is available or not. Other fields are added
to the collection url-database, these fields are created and
fed from the collection in the log files of the Proxy, from
Fig. 1. Experimental Scenario the URLs accessed by the user : user, protocol_type and
access_date. The user and access_date fields bring the
To carry out the experiments, tools based on free software user and the date/time of the access attempt, finally the
(Anti Spam Zimbra and Firewall PfSense) were used with protocol_type field brings the protocol present in the URL,

Authorized licensed use limited to: Tsinghua University. Downloaded on December 19,2020 at 02:03:34 UTC from IEEE Xplore. Restrictions apply.
HTTP or HTTPS. The addition of these fields represents url-database collection, collecting and verifying the mail-
one of the contributions present in this work, where through database collection and building the collection url-scrapy.
Strings search engines, the developed application is able to During the verification step of url-database, the API
detect important characteristics of the URLs. will search for the keyword in the log file generated by a
The mail-database collection stores information related proxy, sequentially, until it finds the string “URL: [url]”.
to email messages and is fed directly from the logs of This search by the proposed search engine captures a URL
the Anti Spam tool. This collection corresponds to the e- accessed by the user, previously monitored by the content
mail checking method proposed in this work. Some fields filter. After capturing this value, it will make a comparison
in the collection can be highlighted: spam, url_content, with the respective collection contained in the database to
file_content, user_associated and source_domain. The spam detect if the URLs obtained are already inserted in the bank
field is responsible for returning a Boolean value whether (figure 3).
the email message was detected or not as Spam by the If the value is found in the database, no action will
tool. Later, this field will allow analyzing which phishing be taken, as the URL has already been inserted into the
messages are being detected or not by the Anti Spam filter. database by importing PhishTank Database. Otherwise, the
The url_content field contains information on whether the API performs a direct query to PhishTank in search of the
checking API detected a redirect link in the message body, URL found in the file read and inserts it in the database
if so, which URL was found. The file_content field tells together with the fields pre-determined in the request. If
you if any files attached to the message body were detected the URL acquired in the log file is not also present in the
by the API, if so, which file was found. Finally, the field PhishTank, the API will insert it into the database with a
source_domain informs the domain that sent the message. mark in the new_detected field, indicating that a URL with
The url-scrapy contains the values of the attack vector characteristics of phishing was detected by the API but was
checks in detecting the characteristics of phishing, being not added as suspicious on the platform.
part of the main proposal of this work. Values are collected In this experiment, the tests performed are limited to the
using the extraction API described in the next subsection. We PhishTank database, not preventing other databases from
can highlight some fields in the collection: redirection_link, being coupled to the architecture in the future, expanding
redirection_url, downloadable_content, downloadable_file, the range of information. The Phishtank Platform allows the
form_fields and cert_validation. The redirection_link field proposed API to perform queries in an integrated manner,
represents a Boolean value, stating whether the analyzed facilitating the comparative framework in detecting URLs.
URL is redirected to other pages. In this verification step, the Figure 3 shows a demonstration of how the collection and
Scraping algorithm can detect redirects made via Javascript, insertion of URLs are carried out.
in addition to conventional redirects made via HREF. If
so, the redirect link will be informed in the redirection_url
field. The downloadable_content field also has a Boolean
value regarding the existence of download content on the
page, if any, information about the file exists, it will be
presented in the downloadable_file field. The form_fields
field informs you if form fields were detected on the an-
alyzed page. Finally, the cert_validation field, if the URL
comes as HTTPS, will contain its authentication certificate.
Even though we know that in current times many URLs
of phishing have a validated certificate, it is important to
analyze which authority is signing the certificate. Later on,
this information can be useful to observe which certificates
are most used by the fraudulent URLs and the comparison
between certificates and valid domains.

C. Extraction and Collection API

To extract the elements and feed the collections, an API
written in Python is used, whose main functionality is
the validation of the URL checking methods proposed in
this work. The API presents the characteristics of a Web
Crawler and uses the principles of extracting information
based on the Scraping technique, performing searches for
the attack vectors present in phishing. Besides, it has the Fig. 3. Python API - Collection and Insertion of URLs
function of performing searches for strings in the log files,
inserting them in the database. API actions can be classified When checking the existence of a URL in the database
into three types: collecting information and updating the in url-database, the values of url-scrapy are simultaneously

Authorized licensed use limited to: Tsinghua University. Downloaded on December 19,2020 at 02:03:34 UTC from IEEE Xplore. Restrictions apply.
checked, inserting it those in the bank. Using the scraping IV. E XPERIMENTS R ESULTS
technique, the API performs the extraction of information
from the chosen page, searching for tags that indicate the User monitoring was carried out from 3/12/2020 to
existence of form fields (step 1 - figure 4), redirection to 7/05/2020, with an hourly data collection frequency (col-
other pages (step 2 - figure 4) and download content (step lection of URLs in log files by the API and sync with
3 - figure 4). If the vectors for a given URL (form_fields, PhishTank). Within this period, it was identified that the
redirection_url, downloadable_file) are already contained in main malicious URLs were linked to the themes: COVID-
the url-scrapy collection, no action will be taken taken by the 19, Government aid and services, Paypal, and frequent flyer
application. Figure 4 shows how the extraction application programs. Each of these themes had specific characteristics,
performs Scraping on the page in search of information. To the URLs related to the coronavirus mostly did not have form
carry out the experiments in this work, we used the creation fields but contained a suspicious file to download or redirect
of access profiles in Proxy based on a Whitelist. Instead of to other malicious pages. The URLs related to government
maintaining a base of blocked URLs (blacklist), a list of services and frequent flyer programs in 100% of cases came
official URLs has been inserted to prevent occurrences of with form fields in their body, requesting confidential creden-
false positives. The API collects and checks the phishing tials. In cases where the URLs presented a simplified layout,
vectors on an official URL. In this way, the Firewall is the proposed API’s characteristics were found with a value
programmed to generate an access log only when the user close to 98% accuracy in up to 10 seconds. Considering only
accesses a URL outside the Whitelist. the phishing pages detected by the API, only a percentage
of approximately 5% had been registered and verified as
phishing on the PhishTank platform during the monitoring
period. Also, 11% of the URLs classified as phishing by the
proposed search engines were not detected as malicious on
the VirusTotal platform. Approximately 15% of these pages
has a valid digital certificate such as Let’s Encrypt on their
home pages, but the pages that contained form fields to fill
in did not contain active encryption.
It is worth highlighting the maneuvers of targeted phish-
ing (spear-phishing and whaling phishing), users who used
emails such as contracts@testdomain, hr@testdomain and
financial@testdomain received more phishing messages tar-
geting their areas of activity than conventional phishing
messages. At the end of the monitoring, malicious messages
in the email mentioned above boxes, approximately 70%
were classified as spear phishing and 30% from other types
of phishing. In many emails, attackers simulated valid emails
from other institutions or other company employees, re-
Fig. 4. Python API - Scraping Engines questing specific financial or contractual data. Most of these
emails did not have the phishing characteristics checked in
Similar to the url_database verification step, when col- this work, in some cases, just an attached file, demonstrating
lecting information for the mail_database, the API will read that the whaling phishing and spear-phishing maneuvers
the log file generated by Anti Spam tool searching for do not always have classic phishing characteristics form
redirect links within the message body and checking for files fields and redirects. This situation demonstrates the broad
attached to the message. The ability to analyze the type of file role of social engineering behind the phishing maneuvers,
attached serves to detect possible targeted malicious actions, making attacks increasingly sophisticated, making it difficult
where malware is disguised as regular documents such as to detect malicious action through the proposed methodology.
spreadsheets and text documents. It is possible to exemplify As for the checking methodology proposed in this article,
some of the strings that can be collected within the log file: the search engines showed varied results when reading
-“Content-Description: [[Link]]”: this string will the pages, depending on the layout and elements used in
check if there is a file attached to the email message, which the pages’ construction. On simplified pages (best case),
is the file and the extension. as easily identifiable elements (HTML and CSS without
-“ˆhttp+”: the application will search the text for the code omission), the application achieved an average of 97%
regular expression, detecting any string that begins with accuracy in detecting form fields and redirect links with
HTTP. This feature will confirm that there is a redirect link an average turnaround time 12 seconds. For the search for
within the body of the email. The URL obtained in this downloadable files and executables on the page, the average
query will also be inserted in the collection url_database was 80% with a return of 20 seconds. Still, within the best
and consequently will pass through the application checks scenario, the highest achieved values of accuracy and time
related to the collection url-scrapy. were 97.66% and 15 seconds. On more complex pages (worst

Authorized licensed use limited to: Tsinghua University. Downloaded on December 19,2020 at 02:03:34 UTC from IEEE Xplore. Restrictions apply.
case), with dynamic rendering elements (called Javascript accuracy in detecting malicious URLs. Another point is to
and code omissions), the algorithm used obtained average make the structure less dependent on capture tools and to
results of 73% accuracy in detecting the elements with a attach the tool to its proxy methodology and filtering of
return above 30 seconds. The Scraping technique proved to email messages. There is also the possibility to investigate
be computationally costly in the interpretation of URLs in the feasibility of implementation only on the client-side
search of phishing characteristics, requiring high processing following the state of the art guidelines.
power. The version of the algorithm proposed in this work is
R EFERENCES
a prototype written in Python. It still needs improvements to
deal with the fact that the vast majority of URLs do not have [1] M. Barrett, “Framework for improving critical infrastructure cyberse-
curity,” National Institute of Standards and Technology, Gaithersburg,
their elements available in a format that can be interpreted MD, USA, Tech. Rep, 2018.
directly by the application. [2] D. Lavion et al., “Pwc’s global economic crime and fraud sur-
vey, 2020,” URL: [Link] pwc. com/gx/en/forensics/global-
V. CONCLUSIONS economiccrime-and-fraud-survey-2020. pdf (retrieved 28 February
2020), 2020.
This article presented a proposal for detecting and analyz- [3] K. Thakur and A.-S. K. Pathan, Cybersecurity Fundamentals: A Real-
ing malicious URLs based on heuristic techniques and web World Perspective. CRC Press, 2020.
[4] A. Abuzuraiq, M. Alkasassbeh, and M. Almseidin, “Intelligent meth-
page scraping. For this purpose, an API was developed in ods for accurately detecting phishing websites,” in 2020 11th In-
Python language that runs its search engines to extract from ternational Conference on Information and Communication Systems
the pages the main phishing characteristics: redirect links, (ICICS), pp. 085–090, IEEE, 2020. [Link]
1109/ICICS49469.2020.239509.
form fields, and download content. The algorithm in the API [5] T. Ahmad, “Corona virus (covid-19) pandemic and work from
can also scan files for keywords such as URLs, domains, home: Challenges of cybercrimes and cybersecurity,” Available at
and attached files. This makes the application capable of SSRN 3568830, 2020. [Link]
3568830.
detecting phishing maneuvers in email messages. [6] D. N. Alharthi, M. M. Hammad, and A. C. Regan, “A taxonomy
Using the collections proposed in this work, it was also of social engineering defense mechanisms,” in Future of Information
possible to analyze which malicious URLs are going un- and Communication Conference, pp. 27–41, Springer, 2020. https:
//[Link]/10.1007/978-3-030-39442-4_3.
noticed by the phishing reporting platforms, demonstrating [7] A. K. Jain and B. B. Gupta, “Two-level authentication approach
cases where fake pages were detected by the methodology to protect from phishing attacks in real time,” Journal of Ambient
proposed in this research and had not yet been assessed as Intelligence and Humanized Computing, vol. 9, no. 6, pp. 1783–1796,
2018. [Link]
phishing on the PhishTank platform, even being online for [8] R. S. Rao and A. R. Pais, “Jail-phish: An improved search engine
more than five days. based phishing detection system,” Computers & Security, vol. 83,
In some situations, URLs detected as phishing by the pp. 246–267, 2019. [Link]
2019.02.011.
proposed algorithm were not recognized as fraud by Virus- [9] A. Koyun and E. Al Janabi, “Social engineering attacks,” Journal
Total, especially those that contained suspicious download of Multidisciplinary Engineering Science and Technology (JMEST),
files and a valid digital certificate. It was also possible to vol. 4, no. 6, pp. 7533–7538, 2017.
[10] A. J. Park, R. N. Quadari, and H. H. Tsang, “Phishing website
observe which phishing maneuvers were detected as Spam, detection framework through web scraping and data mining,” in 2017
highlighting the cases in which false messages are intended 8th IEEE Annual Information Technology, Electronics and Mobile
for infection by malicious code through files attached to Communication Conference (IEMCON), pp. 680–684, IEEE, 2017.
[Link]
the message. It was also evident in the experiments from [11] K. L. Chiew, J. S.-F. Choo, S. N. Sze, and K. S. Yong, “Leverage
the period 3/12/2020 to 7/05/2020, that the main malicious website favicon to detect phishing websites,” Security and Communi-
maneuvers involve themes associated with COVID-19 and cation Networks, vol. 2018, 2018. [Link]
2018/7251750.
government services. [12] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning
This work has language independence when compared to based phishing detection from urls,” Expert Systems with Applications,
the related works presented in section II. It has achieved vol. 117, pp. 345–357, 2019. [Link]
eswa.2018.09.029.
accuracy in detecting phishing characteristics, which can [13] C. H. M. Souza, M. O. Lemos, F. S. D. Silva, and R. L. S. Alves,
vary between 73.3% and 97.66%. The lowest accuracy “Phishkiller: Uma ferramenta para detecç ao e mitigaç ao de ataques de
values were observed in situations where the pages present phishing através de técnicas de deep learning,” in Brazilian Symposium
on Information and Computational Systems Security, 2019.
Javascript executing redirects. The scraping technique pro- [14] D. G. Dobolyi and A. Abbasi, “Phishmonger: A free and open source
posed in this work has some limitations in extracting infor- public archive of real-world phishing websites,” in 2016 IEEE Confer-
mation from pages with more complex structures, which use ence on Intelligence and Security Informatics (ISI), pp. 31–36, IEEE,
2016. [Link]
other languages embedded in the layout. Heavier pages took [15] W. Santos, E. Fazzion, O. Fonseca, Í. Cunha, M. H. Chaves,
response time over the 30 seconds to return the extracted C. Hoepers, K. Steding-Jessen, D. Guedes, and W. Meira Jr, “Uma
values, especially regarding the verification of hyperlinks. metodologia para agrupamento e extraç ao de informaç oes de urls de
phishing,” in Brazilian Symposium on Information and Computational
Also, the structure is dependent on a whitelist previously Systems Security, 2019.
configured in the Firewall, containing a list of official URLs,
thus avoiding a large number of false positives and checking
real pages.
As future work we intend to improve the search meth-
ods that scan pages for phishing elements, to increase the

Authorized licensed use limited to: Tsinghua University. Downloaded on December 19,2020 at 02:03:34 UTC from IEEE Xplore. Restrictions apply.