Phishing URL Detection

Home
Phishing URL Detection

Project information

Name: Phising URL Detection
Type: Internship
Project date: 15 May,2023
Project URL: Deployed App Link

Phishing URL Detection

Machine Learning (Internship)
Explore my Repositories. »

Introduction · Data Information · Contact

Problem Statement

With the development of Internet technology, network security is under diverse threats. In particular, attackers can spread malicious uniform resource locators (URL) to carry out attacks such as phishing and spam. The research on malicious URL detection is significant for defending against these attacks. However, there are still some problems. For instance, malicious features cannot be extracted efficiently. Some existing detection methods are easy to evade by attackers. We design a machine learning model, to detect whether the url can be risky or not.

Deployed app

Deployed app link

Introduction

This project aims to develop a machine learning model that can detect risky urls by digging deep into the url features. The goal is to develop a model that can learn the features of URL and return a accurate results for the legitimacy of the url. We have tried to generate the features in an exactly similar way as to the research. All the models and data are tracked and maintained using DVC and MLflow.

Dataset Information

Download the original dataset here : Phishing Web Site Dataset
This Dataset was part of the reasearch for Phishing Domain Detection by Rami M. Mohammad, Fadi Thabtah and Lee McCluskey.
The Dataset was published in 2014.
The Dataset contains 11055 records and 31 features.
The dataset is split into two subsets: a training set and a test set.
Attribute Information

IP Address Usage: Detects the presence of an IP address in the URL instead of a domain name.
Long URL to Hide Suspicious Part: Identifies long URLs that may be used to hide suspicious parts or obfuscate the actual destination.
URL Shortening Services (e.g., TinyURL): Detects the use of URL shortening services, which can be used to mask the actual destination URL.
URL's with "@" Symbol: Checks for the presence of an "@" symbol in the URL, which is uncommon and potentially indicative of a phishing attempt.
Redirecting using "//": Identifies the use of double slashes ("//") in the URL, which can be used for URL redirecting and potentially lead to malicious websites.
Adding Prefix or Suffix to Domain: Detects the addition of prefixes or suffixes to a legitimate domain name, which can be an attempt to deceive users.
Subdomain and Multi Subdomains: Checks for the presence of subdomains or multiple subdomains in the URL, which can be used for phishing or impersonation.
HTTPS (Hyper Text Transfer Protocol with Secure Sockets Layer): Determines if the website uses HTTPS, a secure protocol that encrypts data transmission between the user and the website.
Domain Registration Length: Examines the length of time the domain has been registered, as longer registrations can indicate a more trustworthy website.
Favicon: Verifies the presence of a favicon, the small icon displayed in the browser tab, which is often absent in fake or phishing websites.
Using Non-Standard Port: Detects the use of non-standard ports in the URL, which can be used for phishing attacks.
Existence of "HTTPS" Token in the Domain: Checks if the domain contains the term "HTTPS," which can be a sign of a fake website attempting to deceive users.
Request URL: Analyzes the URL to determine if it matches the expected URL of the website.
URL of Anchor: Checks the URL linked to an anchor tag to ensure it corresponds to the expected destination.
Links in <Meta>, <Script>, and <Link> tags: Examines the URLs present in these HTML tags to identify any discrepancies or potentially malicious links.
Server Form Handler (SFH): Verifies if the form's action attribute points to a different domain, which can indicate a phishing attempt.
Submitting Information to Email: Detects if the form's action attribute submits data to an email address, which can be indicative of a phishing attack.
Abnormal URL: Checks for any unusual or suspicious patterns in the URL that could indicate phishing or impersonation attempts.
Website Forwarding: Identifies the use of JavaScript or HTML redirects, which can redirect users to malicious websites.
Status Bar Customization: Checks if the website attempts to customize or hide the browser's status bar, which can be a sign of malicious intent.
Disabling Right Click: Detects if the website disables the right-click function, which can be used to prevent users from accessing browser functionalities and potentially hide malicious actions.
Using Pop-up Window: Identifies the use of pop-up windows, which can be used for phishing or to deceive users.
IFrame Redirection: Checks for the presence of hidden iframes, which can redirect users to malicious websites or content.
Age of Domain: Determines the length of time the domain has been active, as newer domains are more likely to be associated with malicious activities.
DNS Record: Checks the DNS record for inconsistencies or signs of tampering that can indicate a malicious website.
Website Traffic: Examines the website's traffic and popularity as an indicator of legitimacy or suspicious activity.
PageRank: Assesses the website's PageRank, a metric that indicates its reputation and relevance, to determine its trustworthiness.
Google Index: Determines if a website is indexed by Google. Phishing webpages often aren't indexed due to their short lifespan.
Number of Links Pointing to Page: Evaluates the legitimacy of a webpage based on the number of external links. Phishing sites typically lack external links, while legitimate sites have at least 2.
Statistical-Reports Based Feature: Relies on statistical reports from organizations like PhishTank and StopBadware. These reports identify top phishing domains, IPs, and provide valuable insights.
Result: Whether the website is phishing or not.