PunyVis: A Visual Analytics Approach for Identifying Homograph Phishing Attacks
Attackers seeking to deceive web users into visiting malicious websites can exploit limitations of the tools intended to help browsers translate domain names containing non-ASCII characters, or internationalized domain names (IDNs). These attacks, called homograph phishing, involve registering Unico...
Gespeichert in:
| Veröffentlicht in: | IEEE Symposium on Visualization for Cyber Security (VIZSEC) (Online) S. 1 - 10 |
|---|---|
| Hauptverfasser: | , , , |
| Format: | Tagungsbericht |
| Sprache: | Englisch |
| Veröffentlicht: |
IEEE
01.10.2019
|
| Schlagworte: | |
| ISSN: | 2639-4332 |
| Online-Zugang: | Volltext |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| Abstract | Attackers seeking to deceive web users into visiting malicious websites can exploit limitations of the tools intended to help browsers translate domain names containing non-ASCII characters, or internationalized domain names (IDNs). These attacks, called homograph phishing, involve registering Unicode domain names that are visually similar to legitimate ones but direct users to distinct servers. Tools exist to identify when domains use non-ASCII characters, which get translated by the Punycode protocol to work with the Domain Name System (DNS); however, these tools cannot automatically distinguish between benign use cases and ones with malicious intent, leading to high rates of false-positive alerts and increasing the workload of analysts looking for evidence of homograph phishing.To address this problem, we present PunyVis, a visual analytics system for exploring and identifying potential homograph attacks on large network datasets. By targeting instances of Punycode that use easily-confusable ASCII characters to spoof popular websites, PunyVis quickly condenses large datasets into a small number of potentially malicious records. Using the interactive tool, analysts can evaluate potential phishing instances and view supporting information from multiple data sources, as well as gain insight about overall risk and threat regarding homograph attacks. We demonstrate how PunyVis supports analysts in a case study with domain experts, and identified divergent analysis strategies and the need for interactions that support how analysts begin exploration and pivot around hypotheses. Finally, we discuss design implications and opportunities for cyber visual analytics. |
|---|---|
| AbstractList | Attackers seeking to deceive web users into visiting malicious websites can exploit limitations of the tools intended to help browsers translate domain names containing non-ASCII characters, or internationalized domain names (IDNs). These attacks, called homograph phishing, involve registering Unicode domain names that are visually similar to legitimate ones but direct users to distinct servers. Tools exist to identify when domains use non-ASCII characters, which get translated by the Punycode protocol to work with the Domain Name System (DNS); however, these tools cannot automatically distinguish between benign use cases and ones with malicious intent, leading to high rates of false-positive alerts and increasing the workload of analysts looking for evidence of homograph phishing.To address this problem, we present PunyVis, a visual analytics system for exploring and identifying potential homograph attacks on large network datasets. By targeting instances of Punycode that use easily-confusable ASCII characters to spoof popular websites, PunyVis quickly condenses large datasets into a small number of potentially malicious records. Using the interactive tool, analysts can evaluate potential phishing instances and view supporting information from multiple data sources, as well as gain insight about overall risk and threat regarding homograph attacks. We demonstrate how PunyVis supports analysts in a case study with domain experts, and identified divergent analysis strategies and the need for interactions that support how analysts begin exploration and pivot around hypotheses. Finally, we discuss design implications and opportunities for cyber visual analytics. |
| Author | Fouss, Brett Gomez, Steven R. Wollaber, Allan B. Ross, Dennis M. |
| Author_xml | – sequence: 1 givenname: Brett surname: Fouss fullname: Fouss, Brett organization: MIT Lincoln Laboratory – sequence: 2 givenname: Dennis M. surname: Ross fullname: Ross, Dennis M. organization: MIT Lincoln Laboratory – sequence: 3 givenname: Allan B. surname: Wollaber fullname: Wollaber, Allan B. organization: MIT Lincoln Laboratory – sequence: 4 givenname: Steven R. surname: Gomez fullname: Gomez, Steven R. organization: MIT Lincoln Laboratory |
| BookMark | eNotkMtOwzAURA0CiVLyBWz8Ayn32okf7KIKaKVKrQR0WzmO3RjaJIrTRfh6iujqSLOYM5p7ctO0jSOEIswQQT9tw8-7s5lCIWcMUM80Csw1XJFES4WSKeRKCn5NJkxwnWacszuSxPgFAJwBzxEnZL05NeM2xGda0DNO5kCLxhzGIdhIi67rW2Nr6tueLivXDMGPodnTRXts973parqpQ6z_omIYjP2OD-TWm0N0yYVT8vn68jFfpKv123JerNJwNg8p86K0DHXuVGmz89C8LKG0RigPGchKotTgMa9AeSs0aMOAaTSq0pJxrfiUPP73BufcruvD0fTj7nIB_wXmF1KB |
| ContentType | Conference Proceeding |
| DBID | 6IE 6IL CBEJK RIE RIL |
| DOI | 10.1109/VizSec48167.2019.9161590 |
| DatabaseName | IEEE Electronic Library (IEL) Conference Proceedings IEEE Xplore POP ALL IEEE Xplore All Conference Proceedings IEL IEEE Proceedings Order Plans (POP All) 1998-Present |
| DatabaseTitleList | |
| Database_xml | – sequence: 1 dbid: RIE name: IEEE/IET Electronic Library (IEL) (UW System Shared) url: https://ieeexplore.ieee.org/ sourceTypes: Publisher |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Computer Science |
| EISBN | 9781728138763 1728138760 |
| EISSN | 2639-4332 |
| EndPage | 10 |
| ExternalDocumentID | 9161590 |
| Genre | orig-research |
| GroupedDBID | 6IE 6IF 6IL 6IN AAJGR AAWTH ABLEC ADZIZ ALMA_UNASSIGNED_HOLDINGS BEFXN BFFAM BGNUA BKEBE BPEOZ CBEJK CHZPO IEGSK OCL RIE RIL |
| ID | FETCH-LOGICAL-i203t-2f6bc2195e8bc41385bb0bca68f0407d71790f15d08fc6909a20291a8d9723983 |
| IEDL.DBID | RIE |
| ISICitedReferencesCount | 3 |
| ISICitedReferencesURI | http://www.webofscience.com/api/gateway?GWVersion=2&SrcApp=Summon&SrcAuth=ProQuest&DestLinkType=CitingArticles&DestApp=WOS_CPL&KeyUT=000792443000008&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D |
| IngestDate | Wed Aug 27 02:33:44 EDT 2025 |
| IsPeerReviewed | false |
| IsScholarly | true |
| Language | English |
| LinkModel | DirectLink |
| MergedId | FETCHMERGED-LOGICAL-i203t-2f6bc2195e8bc41385bb0bca68f0407d71790f15d08fc6909a20291a8d9723983 |
| PageCount | 10 |
| ParticipantIDs | ieee_primary_9161590 |
| PublicationCentury | 2000 |
| PublicationDate | 2019-Oct. |
| PublicationDateYYYYMMDD | 2019-10-01 |
| PublicationDate_xml | – month: 10 year: 2019 text: 2019-Oct. |
| PublicationDecade | 2010 |
| PublicationTitle | IEEE Symposium on Visualization for Cyber Security (VIZSEC) (Online) |
| PublicationTitleAbbrev | VIZSEC |
| PublicationYear | 2019 |
| Publisher | IEEE |
| Publisher_xml | – name: IEEE |
| SSID | ssj0003203511 |
| Score | 2.1034303 |
| Snippet | Attackers seeking to deceive web users into visiting malicious websites can exploit limitations of the tools intended to help browsers translate domain names... |
| SourceID | ieee |
| SourceType | Publisher |
| StartPage | 1 |
| SubjectTerms | cyber security homograph phishing human factors Human-centered computing-Visualization- Visualization application domains-Visual analytics Security and privacy-Systems security-Browser security Unicode visual analytics visualization design |
| Title | PunyVis: A Visual Analytics Approach for Identifying Homograph Phishing Attacks |
| URI | https://ieeexplore.ieee.org/document/9161590 |
| WOSCitedRecordID | wos000792443000008&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| link | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV3PS8MwFA5zePA0dRN_k4NHs3Vt2iTehjh2mgV17DbSJA8L2o2tFfSvN0m7ieDFU0JIID9IXvLyvu9D6CZkkDAIOFEcgFAaGMKBZSSmWgoOOo6U9GITbDrl87lIW-h2h4UxxvjgM9N3Wf-Xr5eqcq6ygXDXE2Ef6HuMJTVWa-dPiUL_J7YN1gnEYJZ_PRlF-TBhLoRL9Jvmv3RUvBkZd_7XgUPU-8Hj4XRnaY5QyxTHqLMVZMDN_uyix7QqPmf55g6PsE0q-YY96YijYsajhj0c22sqrvG5HuOEJ8v3mrcap6-1RwqPytJh73voZfzwfD8hjWICye3wSxJCkil7BsWGZ8qaJx5nWZApmXCwm5Vp5vi4YBjrgIOy72IhwyAUQ8m1Ex8TPDpB7WJZmFOEIdGcApWcaaCZrQzCNpAOuKtARvEZ6rr5WaxqUoxFMzXnfxdfoAO3BHUU3CVql-vKXKF99VHmm_W1X8lvPkifqA |
| linkProvider | IEEE |
| linkToHtml | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV1bS8MwFD6MKejT1E28mwcf7da1aZP4NsQxcc6Cc-xtpLlgQTfZWkF_vUlaJ4IvPqWEJORCepKT830fwEVAdEy0Tz1BtfYw9pVHNUm9CEvOqJZRKLgTmyCjEZ1OWVKDyzUWRinlgs9U2366t3y5EIV1lXWYPZ4wc0HfiDAO_BKttfaohIF7FfsO1_FZZ5J9PiqBaTcmNoiLtasGfimpOEPSb_yvCzvQ-kHkoWRta3ahpuZ70PiWZEDVDm3CQ1LMPybZ6gr1kEkK_oIc7YglY0a9ij8cmYMqKhG6DuWEBovXkrkaJc-lTwr18tyi71vw1L8ZXw-8SjPBy8zwcy_QcSrMXyhSNBXGQNEoTf1U8Jhqs12JJJaRS3cj6VMtzM2Y8cAPWJdTaeXHGA33oT5fzNUBIB1LijXmlEiNU1NYM1OBW-iu0DyMDqFp52f2VtJizKqpOfo7-xy2BuP74Wx4O7o7hm27HGVM3AnU82WhTmFTvOfZannmVvULvCai7w |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=proceeding&rft.title=IEEE+Symposium+on+Visualization+for+Cyber+Security+%28VIZSEC%29+%28Online%29&rft.atitle=PunyVis%3A+A+Visual+Analytics+Approach+for+Identifying+Homograph+Phishing+Attacks&rft.au=Fouss%2C+Brett&rft.au=Ross%2C+Dennis+M.&rft.au=Wollaber%2C+Allan+B.&rft.au=Gomez%2C+Steven+R.&rft.date=2019-10-01&rft.pub=IEEE&rft.eissn=2639-4332&rft.spage=1&rft.epage=10&rft_id=info:doi/10.1109%2FVizSec48167.2019.9161590&rft.externalDocID=9161590 |