A quantitative approach to estimate a website security risk using whitelist

  • Authors:
  • Young-Gab Kim;Minsoo Lee;Sanghyun Cho;Sungdeok Cha

  • Affiliations:
  • Department of Computer Science and Engineering, College of Information and Communication, Korea University, 1, 5-ga, Anam-dong, Sungbuk-gu, 136-701, Seoul, Korea;Division of Computer Science, Department of EECS, Korea Advanced Institute of Science and Technology (KAIST), 335 Gwahangno (373-1 Guseong-dong), Yuseong-gu, 305-701, Daejeon, Korea;Portal Service Security Team, NHN Business Platform, Venture Town Bldg, Jeongja-dong, Bundang-gu, Seongnam-si, 25-1, Gyeonggi-doKorea;Department of Computer Science and Engineering, College of Information and Communication, Korea University, 1, 5-ga, Anam-dong, Sungbuk-gu, 136-701, Seoul, Korea

  • Venue:
  • Security and Communication Networks
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Despite much research on defense against phishing attacks, incidents continue to occur where sensitive (e.g., personal or financial) information is stolen using social engineering and technical spoofing techniques. Most approaches use the notions of blacklists versus whitelists (WWLs), and it is difficult to quantify the degree of a website's vulnerability against phishing attacks. In this paper, we present a quantitative approach for evaluating the phishing possibility of a given website using the refined security risk elements for domain and web page. Design and implementation of the website risk assessment system for antiphishing are also included. It can detect suspicious websites containing phishing attack and abnormal behavior and generates a warning if website is judged untrustworthy. Copyright © 2012 John Wiley & Sons, Ltd.