International Journal for Advanced Research in Science & Technology

Cybersecurity faces a major challenge in maintaining the confidentiality and integrity of personal user information such as passwords and PIN codes.Every day, billions of users are exposed to fake login pages that request sensitive information.There are many ways to trick users into visiting websites, such as phishing emails, bait-and-switch ads, clickjacking, malware, SQL injection, session hijacking, man-in-the-middle, denial of service, and cross-site scripting attacks.Web spoofing, or phishing, is an electronic trick in which an attacker creates a malicious copy of a legitimate webpage and requests personal user information such as passwords.To combat such attacks, researchers have proposed several security strategies, but they suffer from latency and accuracy issues.To overcome such problems, we propose and develop a client-side defense mechanism based on machine learning techniques to detect fake websites and protect users from phishing attacks.As a proof of concept, a Google Chrome extension called PhishCatcher is developed that implements a machine learning algorithm to classify URLs as suspicious or trustworthy.The algorithm takes four different types of web features as input and uses a random forest classifier to determine whether a login web page is fake or not.To evaluate the accuracy and precision of the extension, several experiments were conducted on real web applications.The experimental results showed an astonishing accuracy of 98.5% and a precision of 98.5% from experiments on 400 classified phishing URLs and 400 legitimate URLs.To measure the latency of the tool, experiments with more than 40 phishing URLs were also conducted.The average response time recorded for PhishCatcher was only 62.5 milliseconds.