Machine-learning code crafts phishing URLs that dodge auto-detection

Here's some phish-AI research: Machine-     learning code crafts phishing URLs that     dodge auto-detection

    Humans, keep your eyes out for dodgy web links

        An artificially intelligent system has been demonstrated generating URLs for phishing websites that appear to evade detection by security tools.

Essentially, the software can come up with URLs for webpages that masquerade as legit login pages for real websites, when in actual fact, the webpages simply collect the entered username and passwords to later hijack accounts.

Blacklists and algorithms – intelligent or otherwise – can be used to automatically identify and block links to phishing pages. Humans should be able to spot that the web links are dodgy, but not everyone is so savvy.

Using the Phishtank database, a group of computer scientists from Cyxtera Technologies, a cybersecurity biz based in Florida, USA, have built DeepPhish, which is machine-learning software that, allegedly, generates phishing URLs that beat these defense mechanisms.

“Through intelligent algorithms, intelligent detection systems have been able to identify patterns and detect phishing URLs with 98.7 per cent accuracy, giving the battle advantage to defensive teams,” claimed Cyxtera's Alejandro Bahnsen claimed earlier this month.

"However, if AI is being used to prevent attacks, what is stopping cyber criminals from using the same technology to defeat both traditional and AI-based cyber-defense systems?"

Training

The team inspected more than a million URLs on Phishtank to identify three different phishing miscreants who had generated webpages to steal people's credentials. The team fed these web addresses into AI-based phishing detection algorithm to measure how effective the URLs were at bypassing the system.

The first scumbag of the trio used 1,007 attack URLs, and only 7 were effective at avoiding setting off alarms, across 106 domains, making it successful only 0.69 per cent of the time. The second one had 102 malicious web addresses, across 19 domains. Only five of them bypassed the threat detection algorithm and it was effective 4.91 per cent of the time.

Next, they fed this information into a Long-Short Term Memory network (LSTM) to learn the general structure and extract features from the malicious URLs - for example the second threat actor commonly used “tdcanadatrustindex.html” in its address.