Real-time Phishing Attack Detection using ML 💻

Abdul Ghani — Thu, 21 May 2020 18:21:06 +0000

My Final Project

So, I've built this project called RPAD-ML in my final year. It is essentially an Android app coupled with a machine learning backend server which detects 🕵️ any link that is a possible phishing site in REALTIME ⚡. It can detect malicious/phishing links from any app. Open any app which has external links 🔗, RPAD-ML will detect it in no time and gives you a warning message⚠️ right away.

Demo

Download RPAD-ML Demo APK

I know there are lots of things available like Google safe browsing. But those are limited to chrome web browser. So, What I've done is used a machine learning model of phishing sites combined with Google safe browsing which when given a URL predicts whether it is a phishing website or not.

Link to Code

abdulghanitech / rpad-ml

Real-time Phishing Attack Detection using ML 💻

rpad-ml

Real-time Phishing Attack Detection using ML 💻

The repo contains code for both the ML server and the Android app which was used to detect phishing sites in real-time. Below is a flow chart of it.

View on GitHub

How I built it

I've got a machine learning model built using dataset of phishing sites.

DATA SELECTION

The dataset is downloaded from UCI machine learning repository. The dataset contains 31 columns, with 30 features and 1 target. The dataset has 2456 observations.

MODELS

To fit the models over the dataset the dataset is split into training and testing sets. The split ratio is 75-25. Where in 75% accounts to training set.

Now the training set is used to train the classifier. The classifiers chosen are:

* Logistic Regression

* Random Forest Classification

* Support Vector Machine

We will see which one fits best in our dataset.

1.Logistic Regression

Fitting logistic regression and creating confusion matrix of predicted values and real values I was able to get 92.3 accuracy. Which was good for a logistic regression model.

2.Support Vector Machine

Support vector machine with a rbf kernel and using gridsearchcv to predict best parameters for svm was a really good choice, and fitting the model with predicted best parameters I was able to get 96.47 accuracy which is pretty good.

3.Random Forest Classification

Next model I wanted to try was random forest and I will also get features importances using it, again using gridsearchcv to get best parameters and fitting best parameters to it I got very good accuracy 97.26.

Random forest was giving very good accuracy. We can also try artificial neural network to get a improved accuracy.

FEATURE IMPORTANCES

ML Model: Phishcoop

Hosting online as a server

I've used the Heroku platform (Hobby plan provided by GitHub education) to host this machine learning model online. I used pickle to save and load the machine learning model and hosted it using Flask.

The idea was to put this as a service and then call it from the android app.

Android App

Essentially, this is the front-end to call this service. I've used Android's accessibility API to access and intercept network. Hence, I got the URLs being opened in any app using this method.

Now, after getting this url, firstly I call the Google safe browsing API to check whether it is a phishing site or not. If yes, I show a warning dialog else I call the machine learning backend server and using the result provided by it I again show warning dialog if the result comes as phishing site.

Additional Thoughts / Feelings / Stories

This was more like a prototype. While it is not that perfect, but hey it works 🙌🏻. And the best thing is I've learnt so much by working on this project 🤓

How to build a PHP remote application update system with Authentication?

Abdul Ghani — Mon, 15 Jan 2018 12:32:32 +0000

Hey there! I have built an application in PHP. It is a paid application and contains a licensing system too.

Now, I want to provide automatic updates to my clients. How should I do it?

One important thing is the update URL should not be accessible by the normal public, only my registered application users can download the file.

To be simple, I want authentication to be done while downloading the updates too so that others can't get updates without buying my application.

Any good PHP code obfuscators which are hard to deobfuscate?

Abdul Ghani — Sun, 14 Jan 2018 13:36:34 +0000

Any good code obfuscators? Tried phpprotect, etc. They just either scramble the identifiers or encode the code in base64. And it seems pretty easy to deobfuscate that. I want something really hard to deobfuscate i.e., get the original code.

Also I tried FOPO.com.ar , actually it was working fine. But after a while my production server started giving error stating that the file in which I'm using FOPO's obfuscated code is Malicious. And the server is automatically deleting the file having FOPO'S obfuscated code.

So guys, can you please suggest any good code obfuscator like FOPO (which uses a cipher key to deobfuscate the code)?

P.S: Free ones first. :P

DEV Community: Abdul Ghani

Real-time Phishing Attack Detection using ML 💻

My Final Project

Demo

Link to Code

abdulghanitech / rpad-ml

Real-time Phishing Attack Detection using ML 💻

rpad-ml

How I built it

DATA SELECTION

MODELS

* Logistic Regression

* Random Forest Classification

* Support Vector Machine

1.Logistic Regression

2.Support Vector Machine

3.Random Forest Classification

FEATURE IMPORTANCES

Hosting online as a server

Android App

Additional Thoughts / Feelings / Stories

How to build a PHP remote application update system with Authentication?

Any good PHP code obfuscators which are hard to deobfuscate?