Detecting Phishing Sites Using ChatGPT

Language Models are Few-Shot Learners

Original

Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. 2020 · 2005

Earlier work this paper cites.

Bitsquatting: exploiting bit-flips for fun, or profit?. In 22nd International World Wide Web Conference, WWW ’13, Rio de Janeiro, Brazil, May 13-17, 2013 , Daniel Schwabe, Virgílio A. F. Almeida, Hartmut Glaser, Ricardo Baeza-Yates, and Sue B. Moon (Eds.). 989–998

Nick Nikiforakis, Steven Van Acker, Wannes Meert, Lieven Desmet, Frank Piessens, and Wouter Joosen. 2013 · 2013

Earlier work this paper cites.

Seven Months’ Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse. In 22nd Annual Network and Distributed System Security Symposium, NDSS 2015, San Diego, California, USA, February 8-11, 2015 . The Internet Society

Pieter Agten, Wouter Joosen, Frank Piessens, and Nick Nikiforakis. 2015 · 2015

Earlier work this paper cites.

Towards Measuring and Mitigating Social Engineering Software Download Attacks. In 25th USENIX Security Symposium, USENIX Security 16 . 773–789

Terry Nelms, Roberto Perdisci, Manos Antonakakis, and Mustaque Ahamad. 2016 · 2016

Earlier work this paper cites.

Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 , Bhavani Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu (Eds.). ACM, 569–586

Panagiotis Kintis, Najmeh Miramirkhani, Charles Lever, Yizheng Chen, Rosa Romero Gómez, Nikolaos Pitropakis, Nick Nikiforakis, and Manos Antonakakis. 2017 · 2017

Earlier work this paper cites.

Dial One for Scam: A Large-Scale Analysis of Technical Support Scams. In 24th Annual Network and Distributed System Security Symposium, NDSS

Najmeh Miramirkhani, Oleksii Starov, and Nick Nikiforakis. 2017 · 2017

Earlier work this paper cites.

Data Breaches, Phishing, or Malware?: Understanding the Risks of Stolen Credentials. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017 , Bhavani Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu (Eds.). ACM, 1421–1434

Kurt Thomas, Frank Li, Ali Zand, Jacob Barrett, Juri Ranieri, Luca Invernizzi, Yarik Markov, Oxana Comanescu, Vijay Eranti, Angelika Moscicki, Daniel Margolis, Vern Paxson, and Elie Bursztein. 2017 · 2017

Earlier work this paper cites.

Surveylance: Automatically Detecting Online Survey Scams. In 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA . IEEE Computer Society, 70–86

Amin Kharraz, William K. Robertson, and Engin Kirda. 2018 · 2018

Earlier work this paper cites.

Improving Language Understanding by Generative Pre-Training

Alec Radford and Karthik Narasimhan. 2018 · 2018

Earlier work this paper cites.

Needle in a Haystack: Tracking Down Elite Phishing Domains in the Wild. In Proceedings of the Internet Measurement Conference 2018, IMC 2018, Boston, MA, USA, October 31 - November 02, 2018 . ACM, 429–442

Ke Tian, Steve T. K. Jan, Hang Hu, Danfeng Yao, and Gang Wang. 2018 · 2018

Earlier work this paper cites.

Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019 . The Internet Society

Victor Le Pochat, Tom van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczynski, and Wouter Joosen. 2019 · 2019

Earlier work this paper cites.

What You See is NOT What You Get: Discovering and Tracking Social Engineering Attack Campaigns. In Proceedings of the Internet Measurement Conference, IMC 2019 . 308–321

Phani Vadrevu and Roberto Perdisci. 2019 · 2019

Earlier work this paper cites.

Phishing Website Detection Based on Multidimensional Features Driven by Deep Learning

Peng Yang, Guangzhen Zhao, and Pengjie Zeng. 2019 · 2019

Earlier work this paper cites.

VisualPhishNet: Zero-Day Phishing Website Detection by Visual Similarity. In CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13, 2020 , Jay Ligatti, Xinming Ou, Jonathan Katz, and Giovanni Vigna (Eds.). ACM, 1681–1698

Sahar Abdelnabi, Katharina Krombholz, and Mario Fritz. 2020 · 2020

Earlier work this paper cites.

To Get Lost is to Learn the Way: Automatically Collecting Multi-step Social Engineering Attacks on the Web. In ASIA CCS ’20: The 15th ACM Asia Conference on Computer and Communications Security, Taipei, Taiwan, October 5-9, 2020 , Hung-Min Sun, Shiuh-Pyng Shieh, Guofei Gu, and Giuseppe Ateniese (Eds.). ACM, 394–408

Takashi Koide, Daiki Chiba, and Mitsuaki Akiyama. 2020b · 2020

Earlier work this paper cites.

It Never Rains but It Pours: Analyzing and Detecting Fake Removal Information Advertisement Sites. In The 17th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, DIMVA 2020 . 171–191

Takashi Koide, Daiki Chiba, Mitsuaki Akiyama, Katsunari Yoshioka, and Tsutomu Matsumoto. 2020a · 2020

Earlier work this paper cites.

Be the Phisher - Understanding Users’ Perception of Malicious Domains. In ASIA CCS ’20: The 15th ACM Asia Conference on Computer and Communications Security, Taipei, Taiwan, October 5-9, 2020 , Hung-Min Sun, Shiuh-Pyng Shieh, Guofei Gu, and Giuseppe Ateniese (Eds.). ACM, 263–276

Florian Quinkert, Martin Degeling, Jim Blythe, and Thorsten Holz. 2020 · 2020

Earlier work this paper cites.

Catching Phishers By Their Bait: Investigating the Dutch Phishing Landscape through Phishing Kit Detection. In 30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021 , Michael Bailey and Rachel Greenstadt (Eds.). USENIX Association, 3757–3774

Hugo L. J. Bijmans, Tim M. Booij, Anneke Schwedersky, Aria Nedgabat, and Rolf van Wegberg. 2021 · 2021

Cited alongside, same era.

Finding Phish in a Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs. In ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna, Austria, August 17-20, 2021 , Delphine Reinhardt and Tilo Müller (Eds.). ACM, 59:1–59:12

Arthur Drichel, Vincent Drury, Justus von Brandt, and Ulrike Meyer. 2021 · 2021

Cited alongside, same era.

Security Analysis on Practices of Certificate Authorities in the HTTPS Phishing Ecosystem. In ASIA CCS ’21: ACM Asia Conference on Computer and Communications Security, Virtual Event, Hong Kong, June 7-11, 2021 , Jiannong Cao, Man Ho Au, Zhiqiang Lin, and Moti Yung (Eds.). ACM, 407–420

Doowon Kim, Haehyun Cho, Yonghwi Kwon, Adam Doupé, Sooel Son, Gail-Joon Ahn, and Tudor Dumitras. 2021 · 2021

Cited alongside, same era.

Knowledge Expansion and Counterfactual Interaction for Reference-Based Phishing Detection. In 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023 , Joseph A. Calandrino and Carmela Troncoso (Eds.). USENIX Association, 4139–4156

Ruofan Liu, Yun Lin, Yifan Zhang, Penn Han Lee, and Jin Song Dong. 2023 · 2023

Closest in time.

LLM-based Attack Scenarios Generator with IT Asset Management and Vulnerability Information. In 2023 6th International Conference on Signal Processing and Information Security (ICSPIS) . 99–103

Takeru Naito, Rei Watanabe, and Takuho Mitsunaga. 2023 · 2023

Closest in time.

Canary in Twitter Mine: Collecting Phishing Reports from Experts and Non-experts. In Proceedings of the 18th International Conference on Availability, Reliability and Security, ARES 2023, Benevento, Italy, 29 August 2023- 1 September 2023 . ACM, 6:1–6:12

Hiroki Nakano, Daiki Chiba, Takashi Koide, Naoki Fukushi, Takeshi Yagi, Takeo Hariu, Katsunari Yoshioka, and Tsutomu Matsumoto. 2023 · 2023

Closest in time.

GPT-4 Technical Report

Original