基于图像的网络钓鱼邮件检测方法研究

doi:10.3969/j.issn.1671-1122.2021.09.008

信息网络安全 ›› 2021, Vol. 21 ›› Issue (9): 52-58.doi: 10.3969/j.issn.1671-1122.2021.09.008

基于图像的网络钓鱼邮件检测方法研究

弋晓洋¹^,², 张健¹^,²()

1.南开大学网络空间安全学院,天津 300350
2.天津市网络与数据安全技术重点实验室,天津 300350

收稿日期:2021-04-27 出版日期:2021-09-10 发布日期:2021-09-22
通讯作者: 张健 E-mail:zhang.jian@nankai.edu.cn
作者简介:弋晓洋（1999—）,女,四川,硕士研究生,主要研究方向为网络安全|张健（1968—）,男,天津,正高级工程师,博士,主要研究方向为云安全、网络安全、系统安全。
基金资助:
国家重点研发计划(2021YFF0307202);天津市新一代人工智能科技重大专项(19ZXZNGX00090);天津市重点研发计划(20YFZCGX00680)

Image-based Phishing Email Detection Method and Implementation

YI Xiaoyang¹^,², ZHANG Jian¹^,²()

1. College of Cyber Science, Nankai University, Tianjin 300350, China
2. Tianjin Key Laboratory of Network and Data Security Technology, Tianjin 300350, China

Received:2021-04-27 Online:2021-09-10 Published:2021-09-22
Contact: ZHANG Jian E-mail:zhang.jian@nankai.edu.cn

摘要/Abstract

摘要：

网络钓鱼邮件攻击是一种利用人的安全防范意识漏洞和软件漏洞的APT攻击手段,其危害极大且攻击事件数量呈逐步上升的趋势。网络钓鱼邮件的样本失衡问题一直是网络安全领域难以解决的问题,而提取邮件正文特征进行分析存在侵犯用户个人隐私的风险。文章提出了一种基于图像的网络钓鱼邮件检测方法,使用Simhash算法将邮件样本转换为图像,并进一步利用LBP方法进行图像特征提取,从而避免了对邮件原始内容进行直接分析,有效保护了用户的隐私。同时,文章采用DCGAN模型进行网络钓鱼邮件数据集的扩充,解决了样本不平衡问题,提升了Inception V3模型对邮件图像进行分类检测的准确性。实验表明,该方法可以有效检测网络钓鱼邮件,实验精确率可达92.8%。

关键词: 网络钓鱼邮件, 图像, 生成式对抗网络, 卷积神经网络

Abstract:

Email phishing attack is an APT attack method that exploits lack of consciousness of cyber security and software vulnerability. It can cause serious damage and the number of attacks is gradually increasing. The class imbalance problem of phishing emails and normal emails has been a difficult topic in the field of cyber security. Extracting the characteristics of email body for analysis also has the risk of infringing the user’s personal privacy. The paper proposed an image-based phishing email detection method. It used Simhash algorithm to transform emails into images, and then used LBP method to extract its features. It could not only retain the original information of emails, but also protected the privacy of users. In the paper, DCGAN model was used to expand the phishing email data set. It solved the class imbalance problem in emails and improved the accuracy of Inception V3 model for image classification. Experiments show that this method can detect phishing emails effectively, and the precision of experiments can reach to 92.8%.

Key words: phishing email, image, generative adversarial networks, conventional neural network

中图分类号:

TP309

弋晓洋, 张健. 基于图像的网络钓鱼邮件检测方法研究[J]. 信息网络安全, 2021, 21(9): 52-58.

YI Xiaoyang, ZHANG Jian. Image-based Phishing Email Detection Method and Implementation[J]. Netinfo Security, 2021, 21(9): 52-58.

图/表 4

参考文献 16

[1]	ALEROUD A, ZHOU Lina. Phishing Environments, Techniques, and Countermeasures: A Survey[J]. Computers & Security, 2017, 68(7): 160-196. doi: 10.1016/j.cose.2017.04.006 URL
[2]	SIADAT H, MEMON N. Detecting Structurally Anomalous Logins within Enterprise Networks [C]//ACM. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Oct 30-Nov 3, 2017, Dallas, TX, USA. New York: ACM, 2017: 1273-1284.
[3]	STRINGHINI G, THONNARD O. That Ain’t You: Blocking Spearphishing Through Behavioral Modelling [C]//Springer. Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), July 9-10, 2015, Milan, Italy. Berlin: Springer, 2015: 78-97.
[4]	LI Xue, ZHANG Dongmei, WU Bin. Detection Method of Phishing Email Based on Persuasion Principle [C]//IEEE. 2020 IEEE 4th Information Technology, Networking, Electronic and Automation Control Conference (ITNEC), April 12-14, 2020, Chongqing, China. New York: IEEE, 2020: 571-574.
[5]	DUMAN S, KALKAN-CAKMAKCI K, EGELE M, et al. Email Profiler: Spearphishing Filtering with Header and Stylometric Features of Emails [C]//IEEE. Computer Software & Applications Conference, June 10-14, 2016, Atlanta, GA, USA. New York: IEEE, 2016: 408-416.
[6]	GASCON H, ULLRICH S, STRITTER B, et al. Reading Between the Lines: Content-agnostic Detection of Spear-phishing Emails [C]//Springer. 21st International Symposium, RAID 2018, September 10-12, 2018, Heraklion, Crete, Greece. Berlin: Springer, 2018: 69-91.
[7]	HU Xuan, LI Banghuai, ZHANG Yang, et al. Detecting Compromised Email Accounts from the Perspective of Graph Topology [C]//ACM. 11th International Conference, June 2016, Nanjing, China. New York: ACM, 2016: 76-82.
[8]	HO G, CIDON A, GAVISH L, et al. Detecting and Characterizing Lateral Phishing at Scale [C]//USENIX. 28th USENIX Security Symposium, August 14-16, 2019, Berkeley, USA. Berkeley: USENIX, 2019: 1273-1290.
[9]	YANG Peng, ZHAO Guangzhen, ZENG Peng. Phishing Website Detection Based on Multidimensional Features Driven by Deep Learning[J]. IEEE Access, 2019, 7(7): 15196-15209. doi: 10.1109/ACCESS.2019.2892066 URL
[10]	YU Gaoqing, FAN Wenqing, HUANG Wei, et al. An Explainable Method of Phishing Emails Generation and Its Application in Machine Learning [C]//IEEE. 2020 IEEE 4th Information Technology, Networking, Electronic and Automation Control Conference (ITNEC), April 12-14, 2020, Chongqing, China. New York: IEEE, 2020: 1279-1283.
[11]	ALOTAIBI R, AL-TURAIKI I, ALAKEEL F. Mitigating Email Phishing Attacks Using Convolutional Neural Networks [C]//IEEE. 2020 3rd International Conference on Computer Applications & Information Security, March 19-21, 2020, Riyadh, Saudi Arabia. New York: IEEE, 2020: 1-6.
[12]	FANG Yong, ZHANG Cheng, HUANG Cheng, et al. Phishing Email Detection Using Improved RCNN Model with Multilevel Vectors and Attention Mechanism[J]. IEEE Access. 2019, 7(1): 56329-56340. doi: 10.1109/Access.6287639 URL
[13]	CHOLLET F. Deep Learning with Python[M]. Greenwich: Manning Publications. 2017.
[14]	VERMA R, HOSSAIN N. Semantic Feature Selection for Text with Application to Phishing Email Detection [C]//IEEE. International Conference on Information Security and Cryptology, November 27-29, 2013, Seoul, Korea. New York: IEEE, 2013: 455-468.
[15]	BERGHOLZ A, CHANG J H, PAASS G, et al. Improved Phishing Detection Using Model-based Features [C]//DBLP. The 5th Conference on Email and Anti-spam, August 21-22, 2008, Mountain View. California, USA: DBLP, 2008.
[16]	FEROZ M N, MENGEL S. Phishing URL Detection Using URL Ranking[EB/OL]. , 2020-12-20.

模型	TPR	FPR	Precision
决策树	0.948	0.042	0.957
LR	0.960	0.046	0.954
贝叶斯	0.956	0.266	0.782
CNN	0.932	0.050	0.928

基于图像的网络钓鱼邮件检测方法研究

Image-based Phishing Email Detection Method and Implementation

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 16

相关文章 15

编辑推荐

Metrics

本文评价

[1]	李彦霖, 蔡满春, 芦天亮, 席荣康. 遗传算法优化CNN的网站指纹攻击方法[J]. 信息网络安全, 2021, 21(9): 59-66.
[2]	朱新同, 唐云祁, 耿鹏志. 基于特征融合的篡改与深度伪造图像检测算法[J]. 信息网络安全, 2021, 21(8): 70-81.
[3]	李丹, 燕婷, 郭瑞. 基于交替量子漫步的量子彩色图像加密算法[J]. 信息网络安全, 2021, 21(6): 45-51.
[4]	郑洪英, 李琳, 肖迪. 面向雾计算的压缩感知图像秘密传输和篡改恢复方案[J]. 信息网络安全, 2021, 21(4): 10-20.
[5]	宋宇波, 马文豪, 胡爱群, 王俊波. 一种基于像素值偏移编解码技术的屏摄隐通道研究[J]. 信息网络安全, 2021, 21(4): 31-38.
[6]	王耀杰, 杨晓元, 刘文超. 基于数字化卡登格的生成图像隐写方案[J]. 信息网络安全, 2021, 21(2): 70-77.
[7]	李桥, 龙春, 魏金侠, 赵静. 一种基于LMDR和CNN的混合入侵检测模型[J]. 信息网络安全, 2020, 20(9): 117-121.
[8]	王湘懿, 张健. 基于图像和机器学习的虚拟化平台异常检测[J]. 信息网络安全, 2020, 20(9): 92-96.
[9]	刘静, 张学谦, 刘全明. 混合Gabor的轻量级卷积神经网络的验证码识别研究[J]. 信息网络安全, 2020, 20(7): 77-84.
[10]	刘恒, 吴德鑫, 徐剑. 基于生成式对抗网络的通用性对抗扰动生成方法[J]. 信息网络安全, 2020, 20(5): 57-64.
[11]	张蕾华, 黄进, 张涛, 王生玉. 视频侦查中人像智能分析应用及算法优化[J]. 信息网络安全, 2020, 20(5): 88-93.
[12]	王蓉, 马春光, 武朋. 基于联邦学习和卷积神经网络的入侵检测方法[J]. 信息网络安全, 2020, 20(4): 47-54.
[13]	毕新亮, 杨海滨, 杨晓元, 黄思远. 基于StarGAN的生成式图像隐写方案[J]. 信息网络安全, 2020, 20(12): 64-71.
[14]	顾兆军, 郝锦涛, 周景贤. 基于改进双线性卷积神经网络的恶意网络流量分类算法[J]. 信息网络安全, 2020, 20(10): 67-74.
[15]	马春光, 郭瑶瑶, 武朋, 刘海波. 生成式对抗网络图像增强研究综述[J]. 信息网络安全, 2019, 19(5): 10-12.