BaitAlarm: Detecting phishing sites using similarity in fundamental visual features

In this paper, we present a new solution, BaitA-larm, to detect phishing attack using features that are hard to evade. The intuition of our approach is that phishing pages need to preserve the visual appearance the target pages. We present an algorithm to quantify the suspicious ratings of web pages based on similarity of visual appearance between the web pages. Since CSS is the standard technique to specify page layout, our solution uses the CSS as the basis for detecting visual similarities among web pages. We prototyped our approach as a Google Chrome extension and used it to rate the suspiciousness of web pages. The prototype shows the correctness and accuracy of our approach with a relatively low performance overhead.