Surachai CHITPINITYON Kasom KOHT-ARSA Surasak SANGUANPONG Anan Phonphoem Office of Computer Services...

•Surachai CHITPINITYON•Kasom KOHT-ARSA•Surasak SANGUANPONG•Anan Phonphoem

•Office of Computer Services•Kasetsart University•E-mail: [email protected]

Automatic Phishing Site Automatic Phishing Site Detection and BlockingDetection and Blocking

•APAN 2008, Haweii 23 January 2008This work is partially supported by Commission of Higher Education (CHE), UniNET, Thailand

2Network Operation Center Kasetsart University Office of Computer Services

Agenda

What is Phishing ? Why Phishing Site Detection and Blocking

are needed? Phishing Site Detection Techniques Proposed Solution: Detection and

Blocking Techniques Current Deployment Future Work


Agenda

What is Phishing ? Why Phishing Site Detection and Blocking Why Phishing Site Detection and Blocking

are needed?are needed? Phishing Site Detection TechniquesPhishing Site Detection Techniques Proposed Solution: Detection and Proposed Solution: Detection and

Blocking TechniquesBlocking Techniques Current DeploymentCurrent Deployment Future WorkFuture Work


What is Phishing ?Attempt to criminally and fraudulently acquire sensitive information, such as usernames, passwords and credit card details

We concentrate only Detection and Blocking phishing site inside campus network


Agenda

What is Phishing ?What is Phishing ? Why Phishing Site Detection and

Blocking are needed? Phishing Site Detection TechniquesPhishing Site Detection Techniques Proposed Solution :Blocking TechniquesProposed Solution :Blocking Techniques Current DeploymentCurrent Deployment Future WorkFuture Work


Why Phishing Site Detection and Blocking are needed?

Steal consumer’personal identity data Financial account credentials


Agenda

What is Phishing ?What is Phishing ? Why Phishing Site Detection and Blocking Why Phishing Site Detection and Blocking

are needed?are needed? Phishing Site Detection Techniques Proposed Solution: Detection and Proposed Solution: Detection and

Blocking TechniquesBlocking Techniques Current DeploymentCurrent Deployment Future WorkFuture Work


Phishing Site Detection Techniques

E-mail Detection at Mail GatewayE-mail Detection at Mail Gateway

https://signin.ebay.com


Agenda


are needed?are needed? Phishing Site Detection TechniquesPhishing Site Detection Techniques Proposed Solution: Detection and

Blocking Techniques Current DeploymentCurrent Deployment Future WorkFuture Work


Detection and Blocking Techniques

Solution 1:Detection: Phishing Site URLBlocking: URL filtering techniques

Solution 2: Detection: Phishing Site Content

BBlocking: Firewall


Campus

Network

Gateway

Phishing Site

Solution 1: Traffic Flows

Phishing Site Detection and Blocking

Engine

Internet


Solution 1: Structure

Communicator

URL Analyzer

Internet

Internet

mirror traffic (incoming)

URL pattern

Regular Expression URL matching

Session Controller

TCP Termination

Phishing site blocking

Phishing Site Detection and Blocking Engine


Campus

Network

Solution 1: Procedure

Gateway


Engine

Internet

Phishing Site

GET

3

1

GET

search

??

Matching

5

FIN2

GET

4

FIN

Phishing URL Lists

2

GET


FilteringFiltering

Solution 1: Session Hijacking

SYN J

SYN K , ACK J+1

ACK K+1

FIN L

ClientClient ServerServer

Data (request)

Data

(reply)Packet will be ignoredPacket will be ignored

Faked FIN by Filtering EngineFaked FIN by Filtering Engine


Solution 1: Session Hijacking

FIN L

ClientClient ServerServerFilteringFiltering

Data (request)

Data

(reply)

Successful filtering

ACK L+1Faked FINFaked FIN

FIN Mignoredignored

Unsuccessful filtering

ACK M+1

FIN L

Faked FINFaked FIN


Solution 1: A Closure Look of Hijacking

tt33 < t < t44

tt3 3 - t- t00 < t < t4 4 -- tt00

tt3 3 - t- t11 < RTT < RTT

Success Condition

From our measurement, From our measurement, tt3 – 3 – tt1 is 1 is less than 0.6 milliseconds. The less than 0.6 milliseconds. The average of average of tt3 –3 – t t1 is about 1 is about 0.2*RTT.0.2*RTT.


Campus

Network

Gateway

Phishing Site

Solution 2: Traffic Flows


Engine

Internet 1 2

34

4


Solution 2: Structure

Communicator

Content Analyzer

Internet

Internet

mirror traffic (outgoing)

Content pattern

Regular Expression

content matching

Firewall

Phishing site blocking

Phishing Site Detection and Blocking Engine


Solution 2: Phishing site pattern


Campus

Network

Solution 2: Procedure

Gateway

Firewall


Engine

Internet

Phishing Site

1

GET

2

GET

2

GET

Phishing

Content Lists

3

Reply

4

Reply

4

Reply

Reply ??

Matching

search

block

5

ReplyX


Agenda



Blocking TechniquesBlocking Techniques Current Deployment Future WorkFuture Work


Current Deployment: Structure

Uninet Thaisarn

OCS KU

firewall

Phishing Site Detection Engine

Ethernet 10 Gbps

CPU : 2xDual Core Xeon 3.0 GhzRAM : 1 GBHD : SATA 1 TB

WebScreen Agent

Ethernet 1 Gbps


Current Deployment: TestingUninet Thaisarn

OCS KU

firewall Google phishing site detection Used “About Google” key word


Agenda



Blocking TechniquesBlocking Techniques Current DeploymentCurrent Deployment Future Work


Future Work

Use picture, such as logo, for detection Use AI to classified phishing site


Q&A


Thank You

Surachai CHITPINITYON Kasom KOHT-ARSA Surasak SANGUANPONG Anan Phonphoem Office of Computer Services...

Documents

Transcript of Surachai CHITPINITYON Kasom KOHT-ARSA Surasak SANGUANPONG Anan Phonphoem Office of Computer Services...