Phishing Detection based on Web Page Similarity

Phishing is a current social engineering attack that results in online identity theft. Phishing Web pages generally use similar page layouts, styles (font families, sizes, and so on), key regions, and blocks to mimic genuine pages in an effort to convince Internet users to divulge personal information, such as bank account numbers and passwords. A novel technique to visually compare an assumed phishing page with the legitimate one is presented. Five important features such as signature extraction, text pieces and their style, images, URL keywords and the overall appearance of the page as rendered by the browser are identified and considered. An experimental evaluation using a dataset collected of 150 real world phishing pages, along with their equivalent legitimate targets has been performed. The investigational results are satisfactory in terms of false positives and false negatives and an efficiency rate of about 98.11% for false positive pages and 92.95% for false negative pages has been obtained.