LEVERAGING MACHINE LEARNING FOR CLIENT-SIDE DEFENSE AGAINST SPOOFING ATTACKS

Abstract

One major obstacle to cybersecurity is the security of passwords and personal identification numbers. Every day, billions of people are tricked by dishonest login screens that request personal information. Phishing emails, clickjacking, spyware, SQL injection, session hijacking, man-in-the-middle attacks, denial of service, and cross-site scripting are just a few of the malicious techniques used to trick people into visiting dangerous websites. To trick victims into disclosing their credentials, the perpetrator builds a phony yet convincingly similar website. Numerous security solutions have been proposed by researchers to address these vulnerabilities; nevertheless, these approaches are prone to inaccuracy and ineffectiveness. We present and put into practice a client-side defense system that uses machine learning to identify phishing attempts and bogus websites. The Google Chrome extension PhishCatcher, which categorizes URLs as trustworthy or suspicious, uses our machine learning algorithm as a proof of concept. After obtaining four web attributes, the random forest classifier assesses the legitimacy of a login page. Several real-world web apps were used to assess the extension's accuracy and validity. When tested on 400 real URLs and 400 phishing URLs, the results showed a precision and accuracy rate of 98.5%. Using forty phishing URLs, we evaluated the latency of our method. By using XGBOOST, a method that assesses datasets using forest trees or ensembles of estimators to optimize features more effectively and achieve higher accuracy, we enhanced Random Forest.