4

I'm currently undertaking my thesis regarding phishing detection. I understand that Google Safe Browsing relies on a constantly updated blacklist in order to classify webpages. Their blacklist does not suffer from the drawback of being unable able to detect zero-hour phishing attacks. After all, the blacklist is generated by a machine learning algorithm, trained daily with tens of millions of data (assuming the "blacklist" they refer to in the paper is indeed the one used by Safe Browsing).

My question is, would there be any reason not to rely on Safe Browsing?

Conversely, given the popularity of Chrome (and Firefox, which maintains their own blacklist; also queries Safe Browsing in case the URL doesn't contain an entry in their list), would there be any reason to opt using a browser extension instead? (like SpoofGuard and Netcraft)

Additionally, why would a company invest in phishing solutions (not enough rep points, see the solutions provided by: Entrust, PhishMe, LookingGlassCyber) when they can just use Safe Browsing?

  • How does machine learning magically detect zero-hour phishing attacks? There is enough phishing which gets not detected by google safe browsing. It's a good tool but not a magic bullet. – Steffen Ullrich Jul 17 '16 at 13:47
  • @SteffenUllrich It's still magic to me at this point, but the idea is a set of generalized features (i.e. is the connection SSL, is the URL excessively long, is the PageRank high, etc) are extracted from a webpage, then is used to build a machine learning classification model. In the paper I linked, they didn't measure the true positive rate (phish correctly classified as phish), but it did boast a false positive rate of 0.1%. – user3044500 Jul 17 '16 at 13:52
  • 1
    Reading the paper they rely on messages send to gmail users and on a few user submitted information. This means some phishing which explicitly excludes recipients with a gmail address has a high chance to not get detected. And a 0.1% false positive rate means that still one in 1000 URLs gets wrongly classified as malicious. Also they target a recall of 90% which mean that they will not detect one in 10 phishing pages. So its good but no magic. – Steffen Ullrich Jul 17 '16 at 15:10
  • Oh, dang. Upon re-reading, I realized recall is the same as TPR. They achieved 94.97%. Thank you for your insights :) I've found my answer. It certainly is no silver bullet, hence the need for companies to invest in additional solutions, to be used in conjunction with the ones built-in with browsers. – user3044500 Jul 17 '16 at 15:23
  • AFAIK firefox also uses Safe Browsing, it's IE what uses a different one. – Ángel Jul 17 '16 at 21:43
3

While Google Safebrowsing is today mostly an offline check against some local database they still require that the browser queries google directly before presenting the phishing warning to the user. This is done to reduce the chance of false positives because the online check has the most up-to-date information. But it still might be considered a privacy problem in some environments.

Apart from that relying only on Google Safebrowsing might not be sufficient. From reading the paper it looks like that they get their input mainly from links to gmail users and a few information reported by the users. This means that the input is biased in a way that an attacker has a good chance of late detection if not targeting gmail users. Thus it might be useful to additionally get other sources which don't have this but another bias.

Also according to their paper they target a recall of 90% to keep the false positive rate at a low 0.1%. This means that one in 10 phishing pages will not be classified as such. Increasing the recall would increase the false positive rate so that they classify too much safe pages as malicious. But there are environments where one rather has a higher recall even if the false positive rate gets larger, i.e. better safe than sorry. Note that these are not arguments against using Google Safebrowsing at all but only arguments against relying too much only on Google Safebrowsing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.