PhishCage: reproduction of fraudulent websites in the emulated internet

This paper introduces PhishCage, an experimental infrastructure for phishing detection systems. Due to the short life time of phishing sites, comparative study of effectiveness, especially universality, among the detection systems is difficult. Our key idea is developing a testbed in which preserved phishing sites can be browsed as if they existed in the wild. According to our survey for phishing detection systems, this paper defines the requirements for the testbed, and designs PhishCage to meet with the requirements. The experiment of PhishCage demonstrates our mapping algorithm for 121 phishing sites into the emulated Japanese Internet topology. We confirm that phishing detection systems can obtain the realistic IP address and autonomous system number of the phishing sites in PhishCage, and few modifications enable the systems to work as if they are in the real Internet. With regard to the experimental results, we analyze the limitation of PhishCage, and finally discuss the feasibility of our emulation technique.