Phishing Defense Research For QR Code

QR codes, a widely used ID barcode, though the properties of QR code makes users life much easier and effective, on other hand security vulnerabilities exist itself, QR codes is used as a novel carrier for phishing attacks. QR codes based phishing is a newly adopted intrusive method, it uses QR codes act as an easy interaction between mobile devices and phishing websites. But traditional phishing attacks use loss of spam to deceive user log on phishing sites. However the current mobile devices have not effective defense against it.In this paper, we perform a large-scale experiment by analyzing abnormal characteristics in phishing URL, and then put forward a method which can be used in the mobile device for QR codes based phishing defense.This paper makes the following contributions:i We characterize QR codes attack strategies, and why it be used as a phishing attack vector.ii We do experiment by analyzing abnormal characteristics, we have extracted and analyzed more than 4,000 to detect URL characteristic, including structural characteristic> lexical characteristic ? trademark and mobile page characteristic. Use these characteristic build a set of vectors, and then do training and judgment in SVM.iii We design software to detect QR codes based phishing on Android. Which can scan QR codes, and check their URL destination to identity malicious phishing?...