Internet Explorer 7 heeft beste phishingdetectie

Where the Data Came From
3Sharp’s first challenge was to ensure that we had the necessary variety and volume of
data to provide a significant body of data for statistical significance. Overall, we aimed to
send at least 100 known phish URLs through each filter. At first, we thought this would be
straightforward, but in practice we saw a phish arrival rate of less than 10 phish/day—
sometimes much less. We also needed to ensure that whenever possible, these known phish
were “fresh”; that is, that they hadn’t already been included in any of the products’ data
feeds or blacklisted by the front-end mail filtering in use at Microsoft, EarthLink, and other
services that use or provide URL reputation services. To prevent bias in our data sources,
8
©2006 3Sharp LLC. All rights reserved.
we intentionally did not take any feeds from known third-party data providers or end users
to the Microsoft Phishing Filter service in IE 7.
We set a requirement of testing each phish URL within 48 hours of its collection to ensure
that the filtering data didn’t get too far ahead of our feeds and skew the results in favor of
products that updated their filter definitions more frequently. Testing of the URLs was done
in random order. Finally, we needed to be able to show that we sent the same URLs through
each product.
In order to fulfill these requirements, we made use of the following message feeds. Known
phish were pulled from the following sources:
• 52% IECC/John Levine spam feed. 3Sharp subscribed to a spam feed provided
by prominent anti-spam activist and researcher John Levine. This feed comprises
between 30,000 and 50,000 known spam messages per day, gathered from a
custom network of several hundred honeypots and spamtraps. The messages were
captured from an incoming SMTP feed at 3Sharp’s lab using a simple SMTP sink that
logs incoming messages to disk. Each message was tagged with a unique GUID for
identification.
• 27% Hotmail feed. One input used by 3Sharp was phishing URLs mined from two
sources of Hotmail data. One source was junk mail identified by users who have
opted in to a mail classification program for Hotmail. This is an opt-in program where
selected Hotmail subscribers are asked roughly once a day to classify an e-mail
message sent to them as good mail or spam. Phishing data was generated identified
from mails classified as spam under this program. In addition, raw direct Hotmail
mail feeds were also mined for keywords that would indicate a high likelihood of
spam or phishing. These feeds were also incorporated into the Hotmail data feed,
and Microsoft placed them into a SQL database for 3Sharp’s use. Each message was
tagged with a unique GUID for identification.
• 17% inbox phish received by 3Sharp personnel during the course of the
study. In order to supplement our phish URL volumes, we had 3Sharp personnel
forward us suspicious messages from their personal inboxes, including our Exchange
server and personal mailboxes on various ISPs and hosted services.
• 4% APWG (Anti-Phishing Working Group) phish list. To provide a live source
for additional phish, we used a small number of known phish from APWG.
Known good URLs were pulled from a feed of randomly selected traffic-weighted URLs
provided by Microsoft. The data set consisted of 500 URLs which had been manually verified
by Microsoft but were independent of, and confirmed not to be included in the Microsoft
Phishing Filter system to ensure testing fairness.