EMD based Visual Similarity for Detection of Phishing Webpages

Phishing has become a severe problem in the Internet society. We propose an effective phishing webpage detection approach using EMD (Earth Mover's Distance) based visual similarity of webpages. Both suspected webpage and protected webpage are first preprocessed into low resolution images respectively. The image level colors and coordinate features are used to represent the image signatures. We then use the EMD method to calculate the signature distances of the two images as their visual similarity. When the visual similarity value is higher than a threshold, we classify the suspected webpage as a phishing webpage to the protected one. As our approach is based on image level color and coordinate features other than HTML, webpage obfuscation scams are neatly cracked. Large scale experiments with 1011 training webpages and 10,279 evaluation webpages are carried out to show high classification precision, phishing recall and applicable time performance for online enterprise solution.