The Study of Phishing Webpage Detection Mechanisms Based on Support Vector Machine and Integrated Feature Extraction Methods

[[abstract]]迎向智慧經濟產業世代，全球市場開始重視FinTech金融科技議題，網路將逐漸取代銀行的部分功能，而網路交易的蓬勃發展將促使企業更加重視資訊安全問題。FinTech目前在臺灣雖然只有開放電子支付業務，但其未來市場不容小覷，相對在資安問題的處理也不容馬虎，尤其網路釣魚攻擊是一種目前常見的網路詐騙手段。隨著網路通訊的發達，釣魚網站的欺騙手段也越來越高明，於偵測釣魚網站攻擊時，其常見的方法為特徵提取。特徵提取是透過數據分析等方式，取得網站重要訊息，找出該網頁的特徵、關鍵字等資訊，並以線性分類器進行分類或預測。本研究首先提出五大特徵提取模組，網址列特徵提取模組用來辨別網址列的偽裝攻擊特徵。網頁異常特徵模組用以判斷網頁與其連結是否在同一網域，以及判斷網頁是否已經失聯。網域特徵提取模組主要是藉由WHOIS數據庫來查詢網頁的網域資訊，若有存活時間過短抑或安全通訊協定的身分偽裝就可能有釣魚網站的可能性。TF-IDF文本挖掘模組結合萊文斯坦距離文字編輯距離模組，主要是用以提取網頁關鍵字，並將提取出的關鍵字匯入搜尋引擎下搜尋，所尋找到的網頁與原始網頁進行萊文斯坦距離(Levenshteindistance)計算，查看其連結是否近似於同一個網域。最後我們將這五大特徵提取模組所提取出的特徵值整合後匯入支援向量機(SVM)來預測及識別釣魚網站。[[abstract]]Towardsthewisdomofeconomicindustrygeneration,globalmarketbegantopayattentiontoFinTech(Financialtechnology).Thenetworktransactionswillgraduallyreplacesomeofthefunctionsinthetraditionalbanks.Thevigorousdevelopmentofonlinetransactionswillenableenterprisestopaymoreattentiontoinformationsecurityissues.FinTechisonlyopentoe-paymentservicescurrentlyinTaiwan.Nevertheless,FinTechcannotbeunderestimatedinfuture.Thehandlingofsecurityissuescannotbesloppysincethephishingattackisacommonmethodofonlinefraud.Today,thephishingattackbecomesmoreandmoresophisticatedwiththeprogressofinternetcommunications.Themajormethodfordetectingthephishingattackisfeatureextractingbyanalyzingtheimportantdataonthewebsitestofindthecharacteristicsofthewebpages,keywordsandotherinformation,andusingalinearclassifiertoclassifyorpredicttheresult.Inthisthesis,wefirstproposefivefeatureextractionmodulesincludingtheaddressbarbasedfeaturesmodule,theabnormalbasedfeaturesmodule,thedomainbasedfeaturesmodule,theTF-IDFtextminingmodule,andtheLevenshteindistanceeditdistancemodule.Theaddressbarbasedfeaturesmoduleisusedtoidentifythecamouflageattackfeatureintheaddressbar.TheAbnormalbasedfeaturesmoduleisusedtodeterminewhetherthewebpageisinthesamedomainasitslink,andwhetherthewebpagehasbeenlost.ThedomainbasedfeaturesmodulequeriesthewebsiteofthedomaininformationthroughtheWHOISdatabase.IfthelifetimeforthedomaininformationistooshortortheSSLidentityiscounterfeit,itmayhavethepossibilityofphishing.TheTF-IDFtextminingmodulecombinedwiththeLevenshteindistanceeditingdistancemoduleisusedtoextractthewebpagekeywords,andsavetheextractedkeywordsintothesearchengineafterperformingtheLevenshteindistancecomputationbythefoundpagesandtheoriginalpagetoseewhetherthelinkissimilartothesamedomain.Finally,wecombinethefeaturevaluesextractedfromthefivefeatureextractionmodulesintothesupportvectormachine(SVM)topredictandidentifythephishingwebpage