Review Article Open Access

Detection of Phishing Websites Hosted in Name Server Flux Networks Using Machine Learning

Thomas Nagunwa1
  • 1 School of Computing and Digital Technology, Birmingham City University, Birmingham, United Kingdom

Abstract

Attackers are increasingly using Name Server IP Flux Networks (NSIFNs) to run the domain name services of their phishing websites in order to extend the duration of their phishing operations. These networks host a name server that manages the Domain Name System (DNS) records of the websites on a network of compromised machines with frequently changing IP addresses. As a result, blacklisting the machines has less impact on stopping the services, lengthening their lifespan and that of the websites they support. High detection delays and the use of fewer, lesser varied detection features limit the proposed solutions for identifying the websites hosted in these networks, making them more susceptible to detection evasions. This study suggests a novel set of highly diverse features based on DNS, network, and host behaviors for fast and highly accurate detection of phishing websites hosted in NSIFNs using a Machine Learning (ML) approach. Using a variety of traditional and deep learning ML algorithms, the prediction performance of our features was assessed in the context of binary and multi-class classification tasks. Our approach achieved optimal accuracy rates of 98.59% and 90.41% for the binary and multi-class classification tasks, respectively. Our approach is a crucial step toward monitoring NSIFN components to mitigate phishing attacks efficiently.

Journal of Computer Science
Volume 20 No. 1, 2024, 10-32

DOI: https://doi.org/10.3844/jcssp.2024.10.32

Submitted On: 28 February 2023 Published On: 12 December 2023

How to Cite: Nagunwa, T. (2024). Detection of Phishing Websites Hosted in Name Server Flux Networks Using Machine Learning. Journal of Computer Science, 20(1), 10-32. https://doi.org/10.3844/jcssp.2024.10.32

  • 1,655 Views
  • 975 Downloads
  • 0 Citations

Download

Keywords

  • Phishing Hostname
  • Name Server Flux Network
  • Machine Learning
  • Deep Learning
  • Flat and Hierarchical Classification