Detection and remediation of Turkish phishing websites

Official URL: https://risc01.sabanciuniv.edu/record=b2586113_(Table of contents)

The rapid development of cyber technologies has made our life easier. Activities such as online banking, e-commerce and, social media have started to become a part of our lives; however, more threat surface has also emerged for attackers to leverage due to them. Phishing attacks are one of the most preferred and well-known cybercrimes by attackers. Attackers use social engineering techniques to obtain victims’ personal information through phishing websites. To remedy this, researchers, on the other hand, have been trying to detect phishing websites by using several approaches. However, after detecting a phishing website, a significant step is to remediate phishing websites as soon as possible to minimize the damage. In this study, we used hybrid CNN+BiLSTM and Random Forest classifiers to detect Turkish phishing websites in real-time. We measured the impact of notifying phishing websites to targeted hosting providers compared to Turkish CERT, USOM. Additionally, we measured phishing website blocking time for three Turkish ISPs. Our work shows no statistically significant difference between sending abuse notifications to USOM and sending abuse notifications to hosting providers. On the other hand, we found that one ISP’s blocking time is slower than another.