A Framework for Predicting Phishing Websites using Neural Networks

In India many people are now dependent on online banking. This raises security concerns as the banking websites are forged and fraud can be committed by identity theft. These forged websites are called as Phishing websites and created by malicious people to mimic web pages of real websites and it attempts to defraud people of their personal information. Detecting and identifying phishing websites is a really complex and dynamic problem involving many factors and criteria. This paper discusses about the prediction of phishing websites using neural networks. A neural network is a multilayer system which reduces the error and increases the performance. This paper describes a framework to better classify and predict the phishing sites using neural networks.


Introduction
Cybercrime refers to any crime that involves a computer and a network, where the computers may or may not have played an instrumental part in the commission of a crime. Computer crime encompasses a broad range of potentially illegal activities. Generally, however, it may be divided into one of two types of categories: (1) crimes that target computer networks or devices directly and (2) crimes facilitated by computer networks or devices, the primary target of which is independent of the computer network or device. Examples for cybercrimes are fraud, spam, cyber terrorism and phishing.
Phishing is a type of online fraud in which a scam artist uses an e-mail or website to illicitly obtain confidential information. It is a semantic attack which targets the user rather than the computer. It is a relatively new internet crime. The phishing problem is a hard problem because of the fact that it is very easy for an attacker to create an exact replica of a good banking website which looks very convincing to users. The communication (usually email) directs the user to visit a web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers that the legitimate organization already has .

Phishing Scams
There are many ways in which someone can use phishing to social engineer someone. For example, someone can manipulate a website address to make it look like you are going to a legitimate website, when in fact you are going to a website hosted by a criminal.
The process of phishing involves five steps namely, planning, setup, attack, collection and identity theft and fraud. During the planning stage the phishers IJCSI International Journal of Computer Science Issues, Vol. 8, Issue 2, March 2011 ISSN (Online): 1694-0814 www.IJCSI.org 331 decide which business to target and determine how to get e-mail addresses for the customers of that business. They often use the same mass-mailing and address collection techniques as spammers. In the setup stage after they know which business to spoof and who their victims are, the phishers create methods for delivering the message and collecting the data. Most often, this involves e-mail addresses and a web page. The attack stage is the step people are most familiar with -the phisher sends a phony message that appears to be from a reputable source. The collection stage is the one in which phishers record the information entered by victims into Web pages or popup windows. The final stage is the Identity theft and Fraud where the phishers use the information they've gathered to make illegal purchases or otherwise commit fraud. As many as a fourth of the victims never fully recover.
If the phisher wants to coordinate another attack, he evaluates the successes and failures of the completed scam and begins the cycle again. Phishing scams take advantages of software and security weaknesses on both the client and server sides .

Approaches to prevent phishing
Despite growing efforts to educate users and create better detection tools, users are still very susceptible to phishing attacks. Unfortunately, due to the nature of the attacks, it is very difficult to estimate the number of people who actually fall victim. A report by Gartner estimated the costs at $1,244 per victim, an increase over the $257 they cited in a 2004 report [9]. In 2007, Moore and Clayton estimated the number of phishing victims by examining web server logs. They estimated that 311,449 people fall for phishing scams annually, costing around 350 million dollars. There are several promising defending approaches to this problem reported earlier.
The first approach is [11] to stop phishing at the email level, since most current phishing attacks use broadcast email (spam) to lure victims to a phishing website .Another approach [10] is to use security toolbars. The phishing filter in IE8 is a toolbar approach with more features such as blocking the user's activity with a detected phishing site.
A third approach is to visually differentiate the phishing sites from the spoofed legitimate sites. Dynamic Security Skins [12] proposes to use a randomly generated visual hash to customize the browser window or web form elements to indicate the successfully authenticated sites.
A fourth approach is two-factor authentication, which ensures that the user not only knows a secret but also presents a security token. However, this approach is a server-side solution. Sensitive information that is not related to a specific site, e.g., credit card information and SSN (Social Security Number), cannot be protected by this approach either. Many industrial antiphishing products use toolbars in Web browsers, but some researchers have shown that security tool bars don't effectively prevent phishing attacks.
The Passpet system, created by Yee et al. in 2006, uses indicators so that users know they are at a previously trusted website. Since all of these proposals require the use of complicated third-party tools, its unclear how many users will actually benefit from them. The newest version of Microsoft's Internet Explorer supports Extended Validation (EV) certificates, coloring the URL bar green and displaying the name of the company. However, a recent study found that EV certificates did not make users less fall for phishing attacks.

Cryptographic Identity Verification Method
Proposals have been made for a scheme that utilises a cryptographic identity verification method that lets remote Web servers prove their identities. However, this proposal requires changes to the entire Web infrastructure (both servers and clients), so it can succeed only if the entire industry supports it. The crypto module encrypts and decrypts data received from the memory under the control of the central processing unit. The security service station likewise also contains a central processing unit including a memory, and a crypto module. This station also contains a comparator for comparing personal identification information with reference personal identification information. Both kinds of information are transmitted to the station from the terminal.

Case Studies on E-Banking Phishing Sites
Phishing occurs despite the growing efforts that are taken to educate users and users are still very much susceptible to phishing attacks. Even the display of Extended Validation certification did not decrease the percentage of users who are made victims of phishing attacks. To stress on the need to predict phishing two case studies have been conducted. Consider the original website and the phished website of a bank namely, the State Bank of India (SBI) which is involved in e-banking. Unless the user is a known visitor of the site it is not possible for him/her to identify the authentication of the site based on its look and feel.When we take a close look at the two sites some differences can be observed, (1) URL is different -The URL of the original site is www.onlinesbi.com [4] and the URL of the phished website is www.sbionline.com [5] and (2) Validation of the EV SSL certificate -Extended Validation Secure Sockets Layer (SSL) Certificates are special SSL Certificates that work with high security Web browsers to clearly identify a Web site's organizational identity.Extended Validation (EV) helps you make sure a Web site is genuine and verified. In original websites, the address bar turns green indicating that the site is secured by an EV certificate.
The following figure 1 is the original website of SBI, The deceiving email was sent to 120 employees informing them that their e-banking accounts are at the risk of being hacked and requested them to log into their account through fake link attached to our email using their usual customer ID and password to verify their balance and then log out normally.
The results of the above experiment are shown in the table 1.The results clearly indicate that target phishing factor is extremely dangerous since almost half of the employees who responded were victimized; particularly, trained employees such as those of IT Department and IT Auditors. Increasing the awareness of all users of e-banking regarding this risk factor is highly recommended.

Phone phishing experiment
A group of 50 employees were contacted by female colleges assigned to lure them into giving away their personal e-banking accounts user name and password (through social and friendly phone conversation with a deceiving purpose in mind). The results were beyond expectations; many of the employees fell for the trick.After conducting friendly conversation with them for some time, our team managed to seduce them into giving away their internet banking credentials for fake reasons. Some of these lame reasons included checking their privileges and accessibility, or for checking its integrity and connectivity with the web server for maintenance purposes, account security and privacy assurance…etc.

Phishing Characteristics and Indicators
Phishing in e-banking is prevalent nowadays. The phishing problem is a hard problem because of the fact that it is very easy for an attacker to create an exact replica of a good banking site, which looks very convincing to users.
Based on case studies conducted 27 features and indicators were gathered and clustered them into six criteria [1]. Those

Neural Networks and Phishing Prediction
We are going to utilize neural network techniques in our new e-banking phishing website detection model as shown in table 3 to find the most important phishing features and significant patterns of phishing characteristic or factors in the e-banking phishing website archive data. Each indicator will range between the input values genuine, doubtful and legitimate. Using these values rules will be formed and the network will be trained to give output that ranges between Very legitimate, legitimate, suspicious, phishy and very phishy.
An artificial neural network (ANN), usually called neural network (NN), is a mathematical Spelling errors 2 Copying website 3 Using forms with Submit button 4 Using pop-up windows 5 Disabling right click Web address bar 1 Long url address 2 Replacing similar char for URL 3 Adding a prefix or suffix 4 Using the @ symbol to confuse 5 Using the hexadecimal char codes Social human factor Each unit in neural network performs a simple computation: it receives signals from its input links and computes a new activation level that it sends along each of its output links. The computation of the activation level is based on the values of each input signal received from a neighboring node, and the weights on each input link. The computation is split into two components. First is a linear component, called the input function, in i that computes the weighted sum of the unit's input values. Second is a nonlinear component called the activation function, g, that transforms the weighted sum into the final value that serves as the unit's activation value, a i .The total weighted input is the sum of the input activations times their respective weights: w a w a    Most neural network learning algorithms, including the follow the current-best-hypothesis In this case, the hypothesis is a network, defined by the current values of the weights. The initial network has randomly assigned weights, usually from the range [-0.5, 0.5]. The network is then updated to try to make it consistent with the examples. This is done by making small adjustments in the weights to reduce the difference between the observed and predicted values. Typically, the updating process is divided into epochs. Each epoch involves updating all the weights for all the examples. For perceptrons, the weight update rule is particularly simple. If the predicted output for the single output unit is O, and the correct output should be T, then the error is given by If the error is positive, then we need to increase O; if it is negative, we need to decrease 0. Now each input unit contributes W j a i to the total input, so if a i is positive, an increase in W j will tend to increase O, and if a i is negative, an increase in W j a i will tend to decrease O. Thus, we can achieve the effect we want with the following rule: where the term a is a constant called the learning rate.
In multilayer networks, there are many weights connecting each input to an output, and each of these weights contributes to more than one output. The back-propagation algorithm is a sensible approach to dividing the contribution of each weight. At the output layer, the weight update rule is given below. There are two differences: the activation of the hidden unit a j is used instead of the input value; and the rule contains a term for the gradient of the activation function. If Err i is the error (T -O) at the output node, then the weight update rule for the link from unity to unit i is , , where g' is the derivative of the activation function g. We will find it convenient to define a new error term A i which for output nodes is defined as Initially all the phishing website details are collected and stored in the phishing website archive. Then it is sent to a preprocessor to convert into machine understandable format.
The result is then stored as records in the database. The database also stores configuration parameters (the 27 phishing indicators that are being extracted from the code). Using the data collected in the database, rules are generated to detect the website phishing rate using the neural network techniques.
Once the neural network has been created it needs to be trained with the existing data in the archive. One way of doing this is initialize the neural net with random weights and then feed it a series of inputs.
We then check to see what its output is and adjust the weights accordingly so that whenever it sees something looking like the existing data it outputs the same result as that data. This is shown in the figure 3, Figure:3-A model for detecting phishing websites

Website Phishing Training Data Sets
For our implementation we plan to use two publicly available datasets to test: the "phishtank" from the phishtank.com [8] .The PhishTank database records the URL for the suspected website that has been reported, the time of that report, and sometimes further detail such as the screenshots of the website, and is publicly available.
The Anti Phishing Working Group (APWG) which maintains a "Phishing Archive" describing phishing attacks. In addition, 27 features are used to train and test the classifiers [7]. We will use a series of short scripts to programmatically extract the above features, and store them in an excel sheet for quick reference. The age of the dataset is the most significant problem, which is particularly relevant with the phishing corpus. E-banking Phishing websites are short-lived, often lasting only in the order of 48 hours. Some of our features can therefore not be extracted from older websites, making our tests difficult. The average phishing site stays live for approximately 2.25 days.

Conclusion
The prediction of phishing websites is essential and this can be done using neural networks. For the prediction of phishing websites, earlier works were done using various data mining classification algorithms were used but the error rate of those algorithms were very high [2]. When an element of the neural networks fails, it can continue without any problem because of its parallel nature. Thus performance can be made better by considering neural networks as it reduces the error and gives better classification. We believe that this framework works better and gives a lower error rate.