PhishLive: A View of Phishing and Malware Attacks from an Edge Router

Malicious website attacks, including phishing, malware, and drive-by downloads have become a huge security threat to today’s Internet. Various studies have been conducted to explore approaches to prevent users from being attacked by malicious websites. However, no studies to date exist on the prevalence of and temporal characteristics of such traffic. In this paper, we developed the PhishLive system to study the behavior of malicious website attacks on users and hosts of the campus network of a large University by monitoring the HTTP connections for malicious accesses (using the Google safe browsing tool). During our experiment of one month, we analyzed over 1 Billion URLs. Our analysis reveals several interesting findings.