Unmasking the Phishermen: Phishing Domain Detection with Machine Learning and Multi-Source Intelligence
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F24%3APU149927" target="_blank" >RIV/00216305:26230/24:PU149927 - isvavai.cz</a>
Result on the web
<a href="https://ieeexplore.ieee.org/document/10575573" target="_blank" >https://ieeexplore.ieee.org/document/10575573</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/NOMS59830.2024.10575573" target="_blank" >10.1109/NOMS59830.2024.10575573</a>
Alternative languages
Result language
angličtina
Original language name
Unmasking the Phishermen: Phishing Domain Detection with Machine Learning and Multi-Source Intelligence
Original language description
In the digital landscape, phishing attacks have rapidly evolved into a major cybersecurity challenge, posing significant risks to individuals and organizations. This short paper presents our preliminary research on detecting phishing domains. Our approach amalgamates intelligence from multiple sources: DNS servers, WHOIS/RDAP, TLS certificates, and GeoIP data. We created a rich 15.8 GB dataset of information about benign and phishing domains, from which we derived a comprehensive 80-feature vector for training and testing machine learning classifiers. We propose preliminary results with a fine-tuned XGBoost model, achieving 0.9716 precision rate, 0.9540 F-1 score, and false positive rate of 0.23%.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/VJ02010024" target="_blank" >VJ02010024: Flow-based Encrypted Traffic Analysis</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2024
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
Proceedings of IEEE/IFIP Network Operations and Management Symposium 2024
ISBN
979-8-3503-2794-6
ISSN
—
e-ISSN
—
Number of pages
5
Pages from-to
1-5
Publisher name
Institute of Electrical and Electronics Engineers
Place of publication
Soul
Event location
Soul
Event date
May 6, 2024
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
001270140300140