Proactive Discovery of Phishing Related Domain Names

Samuel Marchal (1, 2) , Jérôme François (1, 2) , Radu State (1, 2, 3) , Thomas Engel (1, 2)

1 Uni.lu - Université du Luxembourg
2 SnT - Interdisciplinary Centre for Security Relaibility and Trust
3 SnT - Interdisciplinary Centre for Security, Reliability and Trust [Luxembourg]

Phishing is an important security issue to the Internet, which has a significant economic impact. The main solution to counteract this threat is currently reactive blacklisting; however, as phishing attacks are mainly performed over short periods of time, reactive methods are too slow. As a result, new approaches to early identify malicious websites are needed. In this paper a new proactive discovery of phishing related domain names is introduced. We mainly focus on the automated detection of possible domain registrations for malicious activities. We leverage techniques coming from natural language modelling in order to build pro-active blacklists. The entries in this list are built using language models and vocabularies encountered in phishing related activities - "secure", "banking", brand names, etc. Once a pro-active blacklist is created, ongoing and daily monitoring of only these domains can lead to the efficient detection of phishing web sites.

Mots clés: phishing; blacklisting; DNS probing; natural language

Domaines: Réseaux et télécommunications [cs.NI]

Samuel Marchal, Jérôme François, Radu State, Thomas Engel. Proactive Discovery of Phishing Related Domain Names. Research in Attacks, Intrusions, and Defenses, Sep 2012, Amsterdam, Netherlands. pp.190-209, ⟨10.1007/978-3-642-33338-5_10⟩. ⟨hal-00748808⟩