text:
\section{Introduction}\label{sec:introduction}
The Internet and its main application -- the Web -- have been growing
continuously in recent years. Just in the last two years
the Web content has doubled in size from $10$ billion to over $20$ billion
pages, according to results from Google and Yahoo \cite{wwwsize}.
Unfortunately, such
growth has been accompanied by a parallel increase
of nefarious activities, as reported by~\cite{increase}.
The web represents a very appealing platform
for various types of electronic fraud, of which {phishing} and
{typosquatting} are two examples.
 \emph{Phishing} is the well-known activity aimed at eliciting sensitive information
-- e.g., usernames, passwords and credit card details -- from unsuspecting users.
It typically starts with a user being directed to a fake web site with
the look-and-feel of a legitimate, familiar and/or well-known web site.
Consequences of phishing can range from denial-of-service to
full-blown identity theft, followed by real financial losses. Only in 2007, more than
3 Billion U.S. dollars were lost to such attacks~\cite{phishloss2007}.
\emph{Typosquatting} is the practice of registering domain names that
are typographical errors (or minor spelling variations) of well-known
web site addresses (target domains) \cite{Wang}.
It is often related to domain parking services and advertisement syndication, i.e. instructing browsers
to fetch advertisements from a server and blending them with content of the
web site that the user intends to visit \cite{Wang}. In addition to displaying
unexpected pages, typo-domains often display malicious, offensive and
unwanted content,   install malware (\cite{googkle,NDSS}) and certain typo-domains of
children-oriented web sites redirect users to adult content \cite{microsoft}. Worse
yet, typo-domains of financial web sites can serve as natural
platforms for {\em passive} phishing attacks\footnote{Passive phishing attacks do not rely on
email/spam campaigns to lead people to access the fake web site. Instead, users
who mis-type a common domain name end up being directed to a phishing web site.}.
Recent studies have assessed the popularity of both types of malicious activities
\cite{Sturgeon,spamscatter}.  For example, in Fall 2008, McAfee Alert
Labs found more than $80,000$ domains typosquatting on just the top $2,000$
web sites~\cite{mcafee}. Also, according to the Anti-Phishing Working Group,
 the number of reported phishing attacks between April 2006 and April
2007 exceeded $300,000$ \cite{phishnumber}.

Nevertheless, the problem remains far from solved and continues to be a race
between the web-fraudsters and the security community.

Our goal is to counter web-fraud by detecting
domains hosting such activities.
Our approach is inspired by several
recent discussions and results within the security community.
Security researchers and practitioners increasingly advocate transition to
HTTPS for all web transactions, similar to that from Telnet to SSH.
Eminent examples of such discussions can be found in~\cite{Weaver}  and~\cite{Lauren}.
Moreover, a recent study~\cite{symmantec-blog}
has pointed out the emergence  of Phishing attacks abusing SSL certificates.
The main goal is to avoid raising the suspision of users by masquerading as
legitimate ``secure'' site.

This leads us to the following questions:
\begin{enumerate}
\item How prevalent is HTTPS on the Internet?
\item How \emph{different} are SSL certificates used by
web-fraudsters from those of legitimate domains?
\item Can we use the information in the SSL certificates  to
identify web-fraud activities such as phishing and typosquatting, without compromising user privacy?
\end{enumerate}

\if 0
This paper makes several contributions, by answering the above questions:
{\bf First}, we present a novel technique to detect web-fraud domains using
HTTPS. It relies on a classifier that analyzes certificates of
such domains. We validate the classifier by training and testing it over data
collected from the Internet. The classifier achieves a detection
accuracy of 80\% and, in some cases, as high as 95\%, with
few false positives.

Our classifier is orthogonal to existing mitigation
techniques and can be integrated with other methods
that do not rely on HTTPS. {\bf Second}, to justify using HTTPS,
we measure the overall prevalence of HTTPS in popular and randomly
sampled Internet domains. We then consider the popularity of HTTPS
in the context of web-fraud by studying its use in phishing and
typosquatting activities. We then analyze, for the first time, all fields of SSL
certificates.
We identify useful features and patterns that represent possible symptoms of web-fraud;
they guide the design of our detection technique. Finally, our findings
serve as an additional motivation for increasing the use of HTTPS, not
only to guarantee confidentiality and authenticity, but also to combat web-fraud.
\fi

\vspace{0.2cm}\noindent{\bf Contributions.} This paper makes several contributions.
First, we measure the overall prevalence of HTTPS in popular and randomly
sampled Internet domains. We then consider the popularity of HTTPS
in the context of web-fraud by studying its use in phishing and
typosquatting activities. We then analyze, for the first time, all fields of SSL
certificates and
we identify useful features and patterns that represent possible symptoms of web-fraud.

Based on the measurement findings, we propose a novel technique to identify web-fraud domains that use
HTTPS, based on a classifier that analyzes certificates of web domains.
We validate the classifier by training and testing it over data
collected from the Internet. The classifier achieves a detection
accuracy over 80\% and, in some cases, as high as 95\%. Our classifier is orthogonal to prior mitigation
techniques and can be integrated with other methods
that do not rely on HTTPS to face a complete range of malicious domains. Also the integration
with pre-existing solutions could improve their efficiency in the context of
potentially critical applications enforcing HTTPS.
Note that the classifier only relies on data in the SSL certificate and not any other private user information. Finally, our findings
serve as an additional motivation for increasing the use of HTTPS, not
only to guarantee confidentiality and authenticity, but also to help combat web-fraud.

\vspace{0.2cm}\noindent{\bf Paper Organization.} The rest of the paper is organized as follows. Section \ref{sec:x509} introduces a
brief overview of X.509 certificates.
Section~\ref{sec:experiments} presents the rationale and details of our measurements and analysis.
In Section~\ref{sec:classifier}, we describe the details of a classifier that detects malicious
domains, based on information obtained from SSL certificates.
Section~\ref{sec:discussion} discusses the implications of our findings and the
limitations of our study. Section~\ref{sec:related}
contains an overview of related work. Finally, we conclude our paper
in Section ~\ref{sec:conclusion}.

\if 0
\begin{table}[t]
\centering {\footnotesize
\begin{tabular}{|l|c|c|c|c|c|}
\hline
{\bf Data set} & {\bf Type } & {\bf Size } & {\bf HTTP Only} & {\bf HTTPS Only}  &  {\bf HTTP \& HTTPS} \\ \hline
\textsf{Alexa}\ & Legitimate/Popular & 100 K & 66\% & 8\% & 26\% \\ \hline
\textsf{.com}\ & Legitimate & 100 K & 79\% & 9\% & 12\% \\ \hlin
\textsf{.net}\ & Legitimate & 100 K & 84\% & 13\% & 3\%\\ \hlin
\textsf{phishing}\ & Phishing & 2811 & 70\% & 5\% & 25\% \\ \hlin
\textsf{typosquatting}\ & Typosquatting & 9830 & 95.1\% & 0\% & 4.9\%\\ \hlin
\end{tabular}}
\caption{\label{table:data set-desc} \vspace{0.1cm}
\textbf{\small Description of Data sets and Utilization of HTTP/HTTPS in them}}
\end{table}
\fi

\begin{figure}[t]
  \centering
  \includegraphics[width=0.45\textwidth, totalheight=0.20\textheight]{x509.eps}
  \caption{\label{fig:x509format} {\small \bf X.509 Certificate Format}}
\end{figure}

\section{X.509 Certificates}\label{sec:x509

The term {\em X.509 certificate} usually refers to
an IETF's PKIX Certificate and CRL Profile of the X.509 v3 certificate standard, as
specified in RFC 5280\cite{x509rfc}. In this paper we are concerned with the public key
certificate portion of X.509. In the rest of the paper, we refer to the public key certificate
format of X.509 as a {\em certificate}, or an {\em SSL/HTTPS certificate}.

According to X.509, a certification authority (CA) issues a certificate binding a public key to an X.500
Distinguished Name (or to an Alternative Name, e.g., an e-mail address or a DNS-entry).
Web-browsers -- such as Internet Explorer, Mozilla/Firefox, Chrome and Safari -- come
with pre-installed trusted root certificates. Browser software makers determine which
CAs are trusted third parties for the browsers' users. The root certificates can be
manually removed or disabled, however,  users rarely do so.
The general structure of an X.509 v3 \cite{x509rfc} certificate is shown in Figure
\ref{fig:x509format}. As discussed later in Section \ref{sec:experiments},
we analyze \textit{all fields} for certificates of both legitimate and malicious domains.

\section{Measurements and Analysis of SSL Certificates}\label{sec:experiments}
We first describe our data sets and how we collect them.
We then present our analysis and show how these results guide the design
of a classifier that detects web-fraud domains.

\subsection{HTTPS Usage and Certificate Harvest} \label{subsec:method-data-sets
Our measurement data was collected mainly during September 2009. It includes three
types of domain sets: \textit{Legitimate, Phishing and Typosquatting}. Each domain
is probed twice. We probe each domain for web existence (by sending an HTTP request)
and for HTTPS existence (by sending an HTTPS request). If a domain responds to HTTPS,
we harvest its SSL certificate. Below, we describe the data sets and the
state of HTTP/HTTPS utilization in them, also summarized
in Table~\ref{table:data set-desc}.

\begin{table}[t]
\centering {\footnotesize
\begin{tabular}{|l|c|c|c|c|}
\hline
{\bf Data set} & {\bf Size } & {\bf HTTP } & {\bf HTTPS }  &  {\bf HTTP } \\
& & {\bf Only } & {\bf Only }  &  {\bf \& HTTPS} \\ \hline
\textsf{Alexa}\ & 100 K & 66\% & 8\% & 26\% \\ \hline
\textsf{.com}\ & 100 K & 79\% & 9\% & 12\% \\ \hlin
\textsf{.net}\ & 100 K & 84\% & 13\% & 3\%\\ \hlin
\textsf{phishing}\ & 2811 & 70\% & 5\% & 25\% \\ \hlin
\textsf{typosquatting}\ & 9830 & 95.1\% & 0\% & 4.9\%\\ \hline%
\end{tabular}}
\caption{\label{table:data set-desc} \vspace{0.1cm}
\textbf{\small Description of Data sets and Utilization of HTTP/HTTPS }}
\end{table}

\vspace{0.2cm}\noindent{\bf Legitimate and Popular Domain Data Sets.}
The following data sets are considered for measurements and analysis of popular and
legitimate domains:\\
{\bf $\bullet$ \textsf{Alexa}}: $100,000$ most popular domains according to \textsf{Alexa}~\cite{alexa} \\
{\bf $\bullet$ \textsf{.com}}: $100,000$ random samples of \textsf{.com}\ domain zone file,
collected from VeriSign\cite{verisign}.\\
{\bf $\bullet$ \textsf{.net}}: $100,000$ random samples of \textsf{.net}\ domain zone
file, collected from VeriSign\cite{verisign}.

\textsf{Alexa}\ \cite{alexa} is a subsidiary of {\sf Amazon.com} known for its
web-browser toolbar and for its web site that reports traffic ranking of Internet web sites.
The company does not provide information on the number
of users using its toolbar, but it claims several millions \cite{alexa-ranking}.
We use \textsf{Alexa}\ ranking as our measure of popularity of legitimate domains. We also randomly
sample \textsf{.com}\ and \textsf{.net}\ to ensure an unbiased data-set.
In the rest of the paper, we use \textsf{Alexa}, \textsf{.com}, and \textsf{.net}\ to denote three respective data sets
containing the domains or certificates harvested as described above.

{\bf We find that 34\% of
\textsf{Alexa}\ domains use HTTPS; 26\% in \textsf{.com}\ and 16\% in \textsf{.net}}. The fact that 34\% of \textsf{Alexa}\ domains respond to HTTPS
indicates a healthy degree of HTTPS usage among popular Internet domains. Our explanation for
lower percentage in \textsf{.net}\ is that, perhaps because \textsf{.net}\ domains are historically non-commercial,
most of them do not require user interaction and do not involve sensitive data, in contrast with
commercial-minded \textsf{.com}\ domains.
\if 0
The observed $34\%$-percent HTTPS utilization represents an {\bf increase} of about $3\%$ over
the \textsf{Alexa}\ set probed 6 months earlier, and $5\%$
over 1 year ago. As a result, it is expectable that this percentage may continue increasing in the
near future.\footnote{We also collected a list of the top $400$ financial
institutions on the Internet from Forbes Magazine~\cite{forbes}. We find that
that $59\%$ use HTTPS, as opposed to $57\%$ 1 year ago.}
\fi

\begin{table*}[t]
\centering {\footnotesize
\begin{tabular}{|l|l|l|l|l|}
\hline
  {\bf Feature} & {\bf Name } & {\bf Type} & {\bf Used in} & {\bf Notes} \\
  & & & {\bf Classifier} & \\ \hline

F1  & md5 & boolean& Yes & The Signature Algorithm of the certificate is \\
& & & & ``md5WithRSAEncryption'' \\ \hline

F2  & bogus subject & boolean & Yes & The subject section of the certificate \\
& & & & has bogus values (e.g., --, somestate, somecity) \\ \hline

F3  & self-signed & boolean & Yes&  The certificate is self-signed \\ \hline

F4  & expired  & boolean & Yes & The certificate is expired \\ \hline

F5  & verification failed & boolean & No & The certificate passes the verification \\
 & & & & of OpenSSL 0.9.8k 25 Mar 2009 (for Debian Linux)  \\ \hline

F6  & common certificate & boolean & Yes & The certificate of the given \\
& & && domain is the same as a certificate of \\
& & & &another domain.\\ \hline

F7  & common serial & boolean & Yes & The serial number of the certificate is the same as \\
& & number  & & the serial of another one.\\ \hline

F8  & validity period & boolean & Yes& The validity period is more than 3 years \\
 & $>$ 3 years & & & \\ \hline

F9  & issuer common & string & Yes& The common name of the issuer \\
 & name & & & \\ \hline

F10 & issuer organization & string & Yes& The organization name of the issuer \\ \hline

F11  & issuer country & string & Yes& The country name of the issuer \\ \hline

F12  & subject country & string & Yes& The country name of the subject\\ \hline

F13  & exact validity & integer & No& The number of days between the starting\\
 & duration & & & date and the expiration date\\ \hline

F14  & serial number & integer & Yes & The number of characters in the serial number \\
 & length & & &  \\ \hline

F15  & host-common & real & Yes & The Jaccard distance value \cite{jaccard-2}\\
& name distance  & & & between host name and common name \\
& & & & in the subject section \\ \hline

\end{tabular}}
\caption{\label{tbl:features} \textbf{\small Features extracted from SSL
certificates}}
\end{table*}

\vspace{0.2cm}\noindent{\bf Phishing Data Set.}
We collected $2,811$ domains considered to be hosting phishing scams.
They were obtained from the PhishTank web site \cite{phishtank} as soon as they are listed. We note that reported
URLs in PhishTank are verified by several users and, as a result, are malicious with high
probability. We consider this data set as a baseline for phishing domains.
We find that a significant percentage -- $30\%$ -- of these phishing web sites employ HTTPS.
This represents a 5\% increase over earlier measurements conducted in October 2008.
a similar trend has also been independently observed in a recent study by Symantec \cite{symmantec-blog}.
Furthermore, we discovered
a number of phishing domains using HTTPS ({\footnotesize$\sim$} 10\%) for which we cannot obtain corresponding
certificates, due to various SSL errors (e.g., illegal certificate size).

\vspace{0.2cm}\noindent{\bf Typosquatting Data Set.}
To collect SSL certificates of typosquatting domains
we first identified the typo domains in our \textsf{.com}\ and \textsf{.net}\ data sets by
using Google's typo correction service~\cite{GoogleSpellChecker}
to identify possible typos in domain names. This results in $38,617$ typo domains.
However, such domains might be
benign domains that {\em accidentally} resemble typos of well-known domains.
We identified the typosquatting domains in this set by detecting the parked domains
among these typo domains using the machine-learning-based
classifier proposed in \cite{ads-portal-class} \footnote{Typosquatters profit
from traffic that accidentally comes to their domains.
One common way of doing that is to host typosquatting domains from some parking
domain service. Parked domains~\cite{parked} are ad-portal domains that
show ads provided by a third-party service called parking service, in the
form of ads-listing~\cite{Wang} so typosquatters may profit from incoming traffic
(e.g., if a visitor clicks on a sponsored link).} .
We discovered that $9,830$ out of $38,617$ are parked domains. We consider these $9,830$ names
as the data set of typosquatting domains.

As shown in Table \ref{table:data set-desc}, the result is that $486$ \textsf{typosquatting}\ domains use HTTPS. They
represent our \textsf{typosquatting}\ SSL certificate corpus. For convenience, when we refer to \textsf{typosquatting}/\textsf{phishing}\
set, we mean the set of \textsf{typosquatting}/\textsf{phishing}\ domains that have SSL certificates.

\vspace{0.2cm}\noindent{\bf Overlapping of Sets.}
There is negligible overlapping among  data sets. The size of the domain intersection between \textsf{.com}\
and \textsf{Alexa}\ is 81 and the size of domain intersection between \textsf{.net}\ and \textsf{Alexa}\
is 17. There is no overlapping between \textsf{phishing}\ and both \textsf{.com}\ and \textsf{.net}. The
typosquatting set is a subset of the union of \textsf{.com}\ and \textsf{.net}\ sets, but it only represents a very small
ratio ($\sim$ 1\% of the union of \textsf{.com}\ and \textsf{.net}\ sets). Surprisingly, there are four phishing domains
that also belong to \textsf{Alexa}\ set, but the ratio of phishing domains in \textsf{Alexa}\ set is extremely small
($\sim$ 0.005\% of \textsf{Alexa}\ set). Thus, popular domains could (in very rare cases) host scam/phishing web sites.

\vspace{0.2cm}\noindent{\bf Take Away.}
Based on the analysis of HTTPS usage in our data sets, we attempt
to answer the first question posed in Section~ \ref{sec:introduction} and assess how prevalent is the usage of HTTPS today,
We find that a significant percentage of popular and legitimate domains already use HTTPS, and so do
a relevant percentage of phishing domains. As a result, we proceed by analyzing the differences
between the certificates of legitimate and fraudulent web sites.

\subsection{Certificate Analysis}
\label{analysis-ssl}

The goal of this analysis is to guide the design of our detection method, the classifier.
One side-benefit of the analysis is that it reveals the differences
between certificates used by fraudulent and legitimate/popular domains.
In total, we identified 15 distinct certificate features listed in Table
\ref{tbl:features}.\footnote{Other features and fields (e.g.,
RSA exponent, Public Key Size, ...) had no substantial differences
between legitimate and malicious domains. These features are omitted due to space limitations.}
Most features map to actual certificate fields, e.g., F1 and F2. Others are
computed from fields in the certificate but are not
directly reflected in the fields, e.g., certificate validation failure (F5) or
Jaccard distance between host name and common name in the subject field (F15).
Note that some features match to boolean values, whereas,
others are integers, reals or strings. Finally, we believe that most
interesting results correspond to: F1 (md5), F3 (self-signed), F4 (expired), F5 (verification failed), F6
(common certificate) and F15 (host-common name distance).

\vspace{0.2cm}\noindent{\bf Analysis of Certificate Boolean Features.}
Features F1--F8 have boolean values, e.g., F1 (md5) is true if the signature algorithm used
in the certificate is ``md5WithRSAEncryption''. The analysis and distributions of these features
(as shown in Table \ref{tbl:boolean-features-analysis}) reveal
interesting and unexpected issues and differences between legitimate and malicious domains.

\subsubsection*{F1 (md5)} 19\% of \textsf{Alexa}\ certificates (24\% and 22 \% of \textsf{.com}\  and \textsf{.net},
respectively) use ``md5WithRSAEncryption''. This feature has a much higher ratio (35\%)
in \textsf{phishing}\ but only 26\% in \textsf{typosquatting}. The higher ratio for \textsf{phishing}\ suggests a
possible correlation between phishing domain certificates and ``md5WithRSAEncryption'' signature
algorithm. We were surprised that such a high percentage of
legitimate domains is using ``md5WithRSAEncryption'' as the signature algorithm
despite the well-known fact that rogue certificates can be constructed using MD5
(\cite{md5-collisions-eurocrypt07}, \cite{md5-collisions-crypto09}) .

\subsubsection*{F2 (bogus subject)} indicates whether the subject fields have some
bogus values (e.g., ``ST=somestate'',  ``O=someorganization'',
``CN=localhost'', ...).
11\% of \textsf{Alexa}\ certificates (7\% and 8\%  of \textsf{.com}\ and \textsf{.net}, respectively)
satisfy this feature. This percentage is much higher (20\%) in \textsf{phishing}\ (29\% in \textsf{typosquatting}).
This might indicate that web-fraudsters fill subject values
with bogus data or leave default values when generating certificates.

\subsubsection*{F3 (self-signed)} 28\% of \textsf{Alexa}\
certificates are self-signed (24\% and 27\% of \textsf{.com}\ and \textsf{.net}, respectively). We did not expect
such a high percentage among legitimate domains. An interesting open question is to
investigate the reason(s) for all these certificates being self-signed; however, this is
out of the scope of our present work. The percentages of self-signed
certificates in \textsf{phishing}\ and \textsf{typosquatting}\ are  36\% and 53\%,
respectively. This is expected, since miscreants running such domains avoid leaving a
trail by obtaining a certificate from a CA, which requires some documentation and payment.
Despite high ratios in legitimate sets, there is a significant variance between the ratios in
the legitimate sets and \textsf{phishing}\ (8-12\%). This variance is even larger between legitimate
sets and \textsf{typosquatting}\ (25-29\%).

\subsubsection*{F4 (expired)} another alarming result is the fraction of expired certificates,
21\% of \textsf{Alexa}\ (25\% and 22\% of \textsf{.com}\ and \textsf{.net}) as well as 26\% and 43\% of
\textsf{phishing}\ and \textsf{typosquatting}, respectively. Such high percentages of expired
certificates are less surprising for \textsf{phishing}\ and \textsf{typosquatting}\ than for
legitimate domains. There is a non-negligible difference in the ratios between
\textsf{phishing}\ and \textsf{Alexa}\ (5\%).

\begin{table}[t]
\centering {\small
\begin{tabular}{| l | l | l | l | l | l |}
\hline
  {\bf Feature} & {\bf \textsf{Alexa}\ } & {\bf \textsf{.com}\ } & {\bf \textsf{.net}\ }  & {\bf phish }  & {\bf typos}\\
  {\bf Name} & {\bf (33905) } & {\bf (21178)} & {\bf (16106)}  & {\bf (839)}  & {\bf (486)}\\
  \hline
F1 & 19\% & 24\%& 22\%& 35\% & 26\%\\ \hline

F2 & 11\% & 7\%& 8\%& 20\%& 29\%\\ \hline

F3 & 28\%& 24\%& 27\%& 36\%& 53\%\\ \hline

F4 & 21\%& 25\%& 22\%& 26\%& 43\%\\ \hline

F5 & 29\%& 40\%& 37\%& 36\%& 70\%\\ \hline

F6 & 33\%& 60\%& 64\%& 72\%& 95\%\\ \hline

F7 & 38\% & 64\%& 68\%& 75\%& 96\%\\ \hline

F8 & 17\% & 14\%& 17\%& 13\%& 19\%\\ \hline

\end{tabular}}
\caption{\label{tbl:boolean-features-analysis} \textbf{\small Analysis of Boolean Certificate Features
(percentages satisfying the features).}}
\end{table}

\subsubsection*{F5 (verification failed)}
we use OpenSSL 0.9.8k \cite{openssl} to validate certificates and find that
29\% of \textsf{Alexa}\ certificates (40\% and 37\% of \textsf{.com}\ and \textsf{.net}) fail verification. Also, 36\% and 70\% of
\textsf{phishing}\ and \textsf{typosquatting}\ certificates fail verification.
The percentages in \textsf{.com}\ and \textsf{.net}\
sets are higher than in \textsf{phishing}\ maybe because these are random domains and mostly unpopular
thus, having a valid certificate is not essential to these domains.

\if 0
We note that these results include those for F3 and F4: certificates failing validation are
those that satisfy F3, F4 or both. An impressive 70\% of certificates in  \textsf{typosquatting}\ fail
validation, even though 53\% are self-signed.
\fi

\subsubsection*{F6 (common certificate) and F7 (common serial number)} F6 indicates
whether the certificate is also used for multiple domains in our data sets.
33\% of certificates in \textsf{Alexa}\ are duplicated (60\% and 64\% of \textsf{.com}\ and \textsf{.net}, respectively).
The percentage goes up to 72\% for \textsf{phishing}\ and 95\% for \textsf{typosquatting}.
F7 indicates whether a certificate serial number is used
in another certificate in our data sets.
38\% of \textsf{Alexa}\ certificates have common serial numbers (33\% were entirely duplicated). Also,
64\% and 68\% of \textsf{.com}\ and \textsf{.net}\ as well as 75\% and 96\% in \textsf{phishing}\ and \textsf{typosquatting}\ satisfy F7.

Certificates in \textsf{phishing}\ and \textsf{typosquatting}\ have higher
duplication ratios than legitimate data sets (especially \textsf{Alexa}) suggesting
that F7, perhaps combined with other features, could be helpful in identifying phishing and
typosquatting domains.

\if 0
As discussed earlier, the intersection between domains in our data sets is very small; thus, the
common certificate percentage is not polluted by accidental duplication.
\fi

\subsubsection*{F8 (validity period $>$ 3 years)} it seems intuitive that malicious domains would not
acquire certificates valid for long periods of time. Thus, we analyze the percentages of certificates
with validity periods exceeding 3 years. \textsf{Alexa}\ has 17\% (14\% and 17\% of \textsf{.com}\ and \textsf{.net}, respectively),
while \textsf{phishing}\ has 13\% and \textsf{typosquatting}\ -- 19\%. We present further details on the exact
duration of validity periods in the analysis of non-boolean features in  Section
\ref{non-boolean-analysis}. As expected, the percentage of
\textsf{phishing}\ certificates satisfying F8 is smaller than that for \textsf{Alexa}. Whereas, percentages
for \textsf{typosquatting}\ and \textsf{Alexa}\ are close.\\

\vspace{0.2cm}\noindent{\bf Analysis of Certificate Non-Boolean Features.}
\label{non-boolean-analysis}
F9--F11 are related to the certificate issuer:
common name, organization name and country. F12 is the certificate subject's country.

\subsubsection*{F9 (issuer common name) and F10 (issuer organization)}\footnote{We present only the result of
\textsf{Alexa}\ and \textsf{phishing}\ due to space limitations but similar conclusions were obtained for other data sets}
some of the common-names are popular in \textsf{phishing}\ but not
in \textsf{Alexa}. For example, ``Equifax'' is the most popular Common-Name for \textsf{phishing}\ (16\%), whereas it
is only $6\%$ in \textsf{Alexa}. (The same holds for the common-name ``UTN''). Also, the percentage
of certificates without common names (``JustNone'') is larger in \textsf{Alexa}\ (16\%) than in \textsf{phishing}\ (4\%).
We make similar observations for organization name. For example, ``Verisign'' represents 10\% of
\textsf{Alexa}\ and 2.5\% in \textsf{phishing}. Also, ``SomeOrganization'' accounts for 11\% in \textsf{phishing}\ and
7\% in \textsf{Alexa}.  Such observations alone are not enough to discriminate phishing from
popular/legitimate domains, but they can be combined with others for more effective discrimination.
It is also interesting to see that a non-trivial percentage of phishing domains still obtain
certificates from legitimate CAs.

\subsubsection*{F11 and F12 (issuer and subject countries)}
the USA (US) and South Africa (ZA) are responsible
for around 50\% and 20\% (respectively) of the certificates for both legitimate/popular and malicious domains.
All other countries account only for 30\%. This is expected since several major CAs are located
US and ZA. The granularity of countries is too coarse to derive useful information and the
field can be easily filled with bogus values.\\

\if 0
\begin{figure*}[t]
  \centering
  \subfigure[]{\label{fig:alexa-cn-issuers}\includegraphics[width=0.45\textwidth, totalheight=0.33\textheight, angle=-90]{figs/alexa-cn-issuers.eps}}
  \subfigure[]{\label{fig:phish-cn-issuers}\includegraphics[width=0.45\textwidth, totalheight=0.33\textheight, angle=-90]{figs/phish-cn-issuers.eps}}
  \caption{\label{fig:cn-issuers} {\small \bf Common Name of Certificates Issuers ((a) \textsf{Alexa}\ and (b) \textsf{phishing})}}
\end{figure*}
\fi

Features F13 to F15 have integer/real values corresponding to: length of certificate
validity period (in days), length of serial number, and Jaccard Distance \cite{jaccard-2}
between the hostname and the common name of the subject. Results of the analysis are shown
using cumulative distribution function (CDF) plots in Figures~\ref{fig:validity-serial-cdf},
and \ref{fig:name-cdf}.

\begin{figure}[t]
  \centering
  \hspace{-0.3cm}
  \subfigure[]{\label{fig:alexa-phish-com-net-cert-year-days-cdf}\includegraphics[width=0.179\textwidth, totalheight=0.18\textheight, angle=-90]{alexa-phish-com-net-cert-year-days-cdf.eps}}
  \hspace{-0.3cm}
  \subfigure[]{\label{fig:alexa-typo-com-net-cert-year-days-cdf}\includegraphics[width=0.179\textwidth, totalheight=0.18\textheight, angle=-90]{alexa-typo-cert-year-days-cdf.eps}}
  \hspace{-0.3cm}
  \subfigure[]{\label{fig:alexa-phish-com-net-cert-serial-length-cdf}\includegraphics[width=0.179\textwidth, totalheight=0.18\textheight, angle=-90]{alexa-phish-com-net-cert-serial-length-cdf.eps}}
  \hspace{-0.3cm}
  \subfigure[]{\label{fig:alexa-typo-com-net-cert-serial-length-cdf}\includegraphics[width=0.179\textwidth, totalheight=0.18\textheight, angle=-90]{alexa-typo-cert-serial-length-cdf.eps}}
  \caption{{\small \bf CDF of Validity Period of \textsf{Alexa}, \textsf{.com}, \textsf{.net}\ and: (a) \textsf{phishing} (b) \textsf{typosquatting}\  and Serial Number Length (c) \textsf{phishing}\ (d) \textsf{typosquatting} }}\label{fig:validity-serial-cdf}
\end{figure}

\subsubsection*{F13 (exact validity duration)} Figure
\ref{fig:alexa-phish-com-net-cert-year-days-cdf}  compares the validity period CDF for \textsf{phishing}\
and legitimate sets. It shows similarities among the distributions: in \textsf{Alexa}, 32\% are valid for
365 days and 10\% for 730, as opposed to 32\% for $365$ days and 17\% for $731$ in \textsf{phishing}.
\textsf{phishing}\ has a gradual increase in validity periods over 731, whereas \textsf{Alexa}\ has a
small jump around $1,095$ (3\%). The longest
validity period is $4,096$ days in \textsf{phishing}\ and $2,918,805$ in \textsf{Alexa}.
Figure \ref{fig:alexa-typo-com-net-cert-year-days-cdf} compares \textsf{typosquatting}\ with the legitimate sets.
The figure clearly shows that typosquatting certificates are valid for smaller number of days
than those in legitimate sets. This difference in distributions is larger than that
of \textsf{phishing}.

\subsubsection*{F14 (serial number length)} a genuine SSL certificate issued by
a reputable CA is more likely to contain a long serial number, which assures uniqueness. The CDF for
serial number length for all data sets in Figure \ref{fig:alexa-phish-com-net-cert-serial-length-cdf}
shows that \textsf{phishing}\ certificates tend to have shorter serial number length than legitimate
certificates, especially, those in \textsf{Alexa}. Around 40\% in \textsf{Alexa}\ have a serial number
of length 39 (18.5\% of 13, 11\% of 15, 11\%, 10\% of 9, 10\% of 23 and 6\% of 11). The
distribution is different for \textsf{phishing}, where 29\% have length of
39 (22\% of 13, 16\% of 9, 11\% of 23, 10\% of 11 and 7\% of 15).
Figure \ref{fig:alexa-typo-com-net-cert-serial-length-cdf}
shows that typosquatting certificates tend to have shorter serial number than
certificates in legitimate sets. Also, the difference between typosquatting and legitimate sets
distributions is larger than that between \textsf{phishing}\ and legitimate sets.

\begin{figure}[t]
  \centering
\hspace{-0.3cm}
  \subfigure[]{\label{fig:alexa-phish-com-net-cert-jdist-cdf}\includegraphics[width=0.18\textwidth, totalheight=0.18\textheight, angle=-90]{alexa-phish-com-net-cert-jdist-cdf.eps}}
\hspace{-0.3cm}
  \subfigure[]{\label{fig:alexa-typo-com-net-cert-jdist-cdf}\includegraphics[width=0.18\textwidth, totalheight=0.18\textheight, angle=-90]{alexa-typo-cert-jdist-cdf.eps}}
  \caption{{\small \bf CDF of Jaccard Distance between Host and Common Name in Subject Field between \textsf{Alexa}, \textsf{.com}, \textsf{.net}\ and : (a) \textsf{phishing} (b) \textsf{typosquatting}}}\label{fig:name-cdf}
\end{figure}

\subsubsection*{F15 (host-common name distance)} we expect the common name
in the subject field to be very similar to the hostname in legitimate certificates.
We intuitively expect that the difference between common name and hostname in malicious domain
certificates is greater than that in legitimate certificates, since malicious domains may not use
complying SSL certificates. This feature captures the Jaccard Distance \cite{jaccard-2} between
hostname and common-name. The Jaccard Distance measures the closeness between two strings
(A and B) and is defined as J(A,B) = (A and B)/(A or B). J(A,B) is basically the size
of the intersection between set A and B divided by the size of their union. Thus, the larger
the Jaccard distance between two strings, the more similar they are.

Figure \ref{fig:alexa-phish-com-net-cert-jdist-cdf} compares the CDF of Jaccard distance of \textsf{phishing}\
and other legitimate sets. As expected, phishing certificates tend to have smaller Jaccard distance
than those in \textsf{Alexa}.  30\% in \textsf{Alexa}\ have a Jaccard Distance of 0 (5\% of 1, 4\% of 0.7 and
several 3-4\% jumps from 0.6 until 0.9). For \textsf{phishing}\ 43\% have a
Jaccard Distance of 0 (4\% a distance of 1 and the main jumps exist between 0 and 0.5 as
opposed to 0.6 to 0.9 in \textsf{Alexa}). The distribution of \textsf{.com}\ (\textsf{.net}) shows a trend different from \textsf{Alexa}.
We observe that \textsf{.com}\ (\textsf{.net}) certificates have smaller Jaccard Distance than
\textsf{phishing}. For example, 90\% (93\%) of certificates in \textsf{.com}\ (\textsf{.net}) have Jaccard distance $\leq~0.2$.
Whereas, $71\%$ in \textsf{phishing}\ have a Jaccard distance of $\leq~0.2$. This might be due to the fact that
domains in \textsf{.com}\ and \textsf{.net}\ sets are random domains and mostly unpopular (the intersections with
Alexa's top 100k domains are negligible). Thus, having a complying SSL certificate is not essential to these domains.
Figure \ref{fig:alexa-typo-com-net-cert-jdist-cdf} compares the Jaccard distance CDF of
typosquatting with legitimate sets. It clearly shows that typosquatting certificates
tend to have smaller Jaccard distance.

\vspace{0.2cm}\noindent\textbf{Summary of Certificate Feature Analysis.}
The most important observations from our analysis are:
\begin{enumerate}
\item{Distributions of malicious sets are significantly different from those
of legitimate sets for several features.}
\item{Around 20\% of legitimate popular domains are still using the signature algorithm
``md5WithRSAEncryption`` despite its clear insecurity.}
\item{A significant percentage ($>30\%$) of legitimate domain certificates are expired
and/or self-signed. Several user studies (e.g. \cite{ssl-usability} and \cite{been-warned-ssl}) show
that an overwhelming percentage (up to 70-80\% in some cases) of users ignore  browser warning messages.
This may explain the unexpected high percentages of expired and
self-signed certificates that we find in the results  of all our data sets. Users simply
ignore those warnings and this gives no incentive for organizations to update and pay
attention to their certificates.}
\item{Duplicate certificate percentages are very high in phishing domains, which points to
the  possibility that phishers use certificates only to display the familiar lock icon
in the browser, hoping that users will not pay attention.}
\item{For some features, the difference in distributions between malicious and legitimate sets is
small. However, these features turn out to be useful in building a classifier (see Section
\ref{sec:classifier}).}
\item{For most features, the difference in distributions between \textsf{Alexa}\ and malicious sets is
larger than that between \textsf{.com}/\textsf{.net}\ and malicious sets.}
\end{enumerate}

\if 0
\begin{figure*}[t]
  \centering
  \subfigure[]{\label{fig:alexa-phish-com-net-cert-jdist-cdf}\includegraphics[width=0.25\textwidth, totalheight=0.20\textheight, angle=-90]{alexa-phish-com-net-cert-jdist-cdf.eps}}
  \subfigure[]{\label{fig:alexa-typo-com-net-cert-jdist-cdf}\includegraphics[width=0.25\textwidth, totalheight=0.20\textheight, angle=-90]{alexa-typo-cert-jdist-cdf.eps}}
  \caption{{\small \bf CDF of Jaccard Distance between Host and Common Name in Subject Field between \textsf{Alexa}, \textsf{.com}, \textsf{.net} and : (a) \textsf{phishing} (b) \textsf{typosquatting}}}\label{fig:name-cdf}
\end{figure*}
\fi
\section{Certificate-based Classifier}\label{sec:classifier}
The analysis in Section \ref{analysis-ssl} showed that several features have
distributions in legitimate data sets that are significantly
different from those in malicious sets. Even though
some show significant differences, relying on a single feature to identify malicious
domains will yield a high rate of false positives.
One approach, is to simply use a set of heuristics. For example, if F1-F8 are all true,
the given domain is malicious with overwhelming probability. However, this might necessitate
performing an exhaustive search over many combinations of heuristics, in order to find the optimal
one. Another possibility is to take advantage of machine-learning algorithms and let them find the best
combination of features. Machine learning algorithms are well suited for classification problems.
We use several machine-learning-based classification algorithms and select the best performer.
Specifically, we consider the following algorithms: Random Forest \cite{randforest}, Support Vector Machines
\cite{svm1, svm2}, Decision Tree \cite{dtree}, Decision Table \cite{dtable}, Nearest Neighbor \cite{mlearn1}
and Neural Networks \cite{mlearn1}. In addition, we explore two optimization techniques for
Decision Trees: Bagging \cite{bagging, boost-bag-c4.5} and Boosting \cite{boosting, boost-bag-c4.5}.
Algorithm descriptions are out of the scope;
we refer to \cite{randforest,svm1,svm2,dtree,dtable,mlearn1,mlearn1,bagging,boost-bag-c4.5,boosting,boost-bag-c4.5}
for relevant background information.

We use precision-recall performance metrics to summarize the performance of a classifier. These metrics consists of the following
ratios: Positive Recall, Positive Precision, Negative Recall, and Negative Precision. We use the term ``Positive'' set to
denote malicious domains (phishing or typosquatting) and ``Negative'' set to refer to legitimate domains.  The positive
(negative) recall value is the fraction of positive (negative) domains that are correctly identified by the classifier.
Positive (negative) precision is the actual fraction of positive (negative) domains in the set identified by the classifier.

We evaluate the performance of the classifier using the ten-fold cross validation method \cite{mlearn1}.
In it, we randomly divide the data set into 10 sets of equal size, perform 10 different training/testing steps
where each step consists of training a classifier on 9 sets and then testing it on the remaining set.
We take the average of all results as the final performance result of the classifier.
We use most of the features discussed in Section \ref{analysis-ssl} to build two binary classifiers:
(1) a Phishing Classifier and (2) a Typosquatting Classifier. The phishing/typosquatting classifier distinguishes
non-phishing/non-typosquatting domains from phishing/typosquatting domains using \textit{only} information
from SSL certificates.

\subsection{Phishing Classifier}
\label{sec:phishclassifier}
We tried different combinations of features in the classifier and the following yielded the best results:
(F1) md5, (F2) bogus subject, (F3) self-signed,
(F4) expired, (F6) common certificate, (F7) common serial number, (F8) validity period
(F9) issuer common name, (F10) issuer organization name, (F11) issuer country,
(F12) subject country, (F14) serial number length and (F15) host-common name distance.

\begin{table}[t]
\centering{
\begin{tabular}{|c|c|c|c|c|}
\hline

Classifier & Positive & Positive & Negative & Negative\\
        & Recall & Precision & Recall & Precision\\
\hline
Random Forest & 0.74 &  0.77&  0.78 & 0.75\\
\hline
SVM  & 0.68 & 0.75 &  0.78 & 0.71\\
\hline
Decision Tree  & 0.70 & 0.79 & 0.81  & 0.73\\
\hline
Bagging - & 0.73 & 0.80 & 0.81  &  0.75\\
Decision Tree  & & &  & \\
\hline
Boosting - & 0.74 & 0.69 &  0.67  & 0.72\\
Decision Tree  & & &  & \\
\hline
Decision Table  & 0.72  & 0.78  & 0.8  &0.74 \\
\hline
Nearest Neighbor  & 0.74  & 0.73  & 0.73  & 0.74 \\
\hline
Neural Networks  & 0.7 & 0.77 &  0.8 & 0.73\\
\hline
\end{tabular}
\caption{Performance of Classifiers - data set consists of: (a)420 phishing certificates and
(b)420 non-phishing certificates (\textsf{Alexa}, \textsf{.com}\ and \textsf{.net}).}
\label{tab:class-1}
}
\end{table}

\begin{table}[t]
\begin{tabular}{|c|c|c|c|c|}
\hline
Classifier & Positive & Positive & Negative & Negative\\
        & Recall & Precision & Recall & Precision\\
\hline
Random Forest & 0.90 & 0.89 &  0.89 & 0.9\\
\hline
SVM  & 0.91 &  0.87&  0.86 & 0.90\\
\hline
Decision Tree  & 0.86 & 0.89 & 0.90  & 0.87\\
\hline
Bagging - & 0.90 & 0.88 & 0.87  & 0.9\\
Decision Tree  & & &  & \\
\hline
Boosting - & 0.89 & 0.81 & 0.80  & 0.88\\
Decision Tree  & & &  & \\
\hline
Decision Table  & 0.90 & 0.84 & 0.82  & 0.90\\
\hline
Nearest Neighbor  & 0.87  & 0.86  & 0.86  & 0.87 \\
\hline
Neural Networks  & 0.87 & 0.89 &  0.90 &0.87 \\
\hline
\end{tabular}
\caption{Performance of Classifiers - Data set consists of: (a)420 phishing domain
certificates and (b)420 popular domain certificates (\textsf{Alexa})}
\label{tab:class-2}
\end{table}

We create two training data sets for two different purposes. The first consists of 840 SSL certificates half
of which are for phishing (positive set) and the other half -- for legitimate (negative set) domains.
Legitimate certificates are those of the 210 top Alexa domains, 105 random .com domains and 105 random .net domains.
That is, half of legitimate certificates are for popular domains and the other half are for legitimate random domains.
The purpose of training on this data set is to create a classifier that differentiates
between phishing and non-phishing domains. Table \ref{tab:class-1} shows performance metric values for different
classifiers. The Bagging classifier shows the highest phishing detection accuracy. Despite the limited number of fields in the certificates
and the dependencies among them, we can build a classifier with 80\% phishing detection accuracy.

The second training data set consists of 840 SSL certificates. Half of these are for phishing domains (positive set)
and the rest -- legitimate certificates for 420 top Alexa's domains (negative set). The purpose is to train the
classifier to differentiate phishing from popular domains. Performance results of different
classifiers are shown in Table \ref{tab:class-2}. The results improve significantly from those in the first training data set.
Random Forest (along with few others) exhibits the best phishing detection accuracy with a rate of 89\%. The
reason is that (as shown in Section \ref{analysis-ssl}) the difference in distributions of many features
between \textsf{Alexa}\ and \textsf{phishing}\ is much larger than that between \textsf{.com}\  (\textsf{.net}) and \textsf{phishing}. Thus, the
random .com and .net certificates are polluting the non-phishing set and making it harder to differentiate.
Although the number of certificate fields is small, we can reliably differentiate phishing from
popular domains with high accuracy.

Similar to machine-learning-based spam filtering solutions, the larger the training data set, the better the performance is.
We believe that our solution may incur false positives when actually deployed. However, the number of false positives
can be reduced by training on larger data sets and newer samples.

We note that the use of the classifier alone cannot
successfully detect \textit{all} phishing web sites, since it only works with HTTPS. However, our approach can be
combined with other phishing mitigation techniques (e.g.,~\cite{wu2006,protectphish,learnphishemails}) to enhance the
overall accuracy. Our results show how clearly limited information pulled from SSL certificates
(which has been overlooked before) can help in distinguishing phishing and legitimate domains in the context of
{\em claimed-to-be} secure navigation.

\subsection{Typosquatting Classifier}
We use the same set of features as in the phishing classifier and
also create two training data sets: the first with certificates of 486 domains from the
typosquatting (positive) data set (see Section \ref{subsec:method-data-sets}) and 486 non-typosquatting (negative)
domains. Half of the negatives are picked randomly from \textsf{Alexa}\ and the rest are random \textsf{.com}\ and \textsf{.net}\ domains
(distributed equally between the two). This training set trains the classifier to differentiate between
typosquatting and non-typosquatting domains. Performance of various classifiers is shown in Table \ref{tab:class-3}.
The metrics are fairly similar across classifiers, however, Decision Tree offers the highest accuracy
with a rate of  93\%.

The second data set consists of the same typosquatting certificates in the previous data set and certificates of
486 \textsf{Alexa}\ top domains. This set is needed to train the classifier to differentiate, typosquatting and popular domains.
Performance results are shown in Table \ref{tab:class-4}. The performance of many classifiers improves
because the difference in distributions of features between \textsf{Alexa}\ and typosquatting data sets is larger than the
difference between \textsf{.com}\ (\textsf{.net}) and typosquatting data sets. The Neural Network classifier shows the highest typosquatting detection accuracy, with
a rate of 95\%.

\begin{table}[t]
\begin{tabular}{|c|c|c|c|c|}
\hline
Classifier & Positive & Positive & Negative & Negative\\
        & Recall & Precision & Recall & Precision\\
\hline
Random Forest & 0.86 & 0.88 & 0.88  & 0.87\\
\hline
SVM  & 0.86 & 0.88 &  0.89 & 0.86\\
\hline
Decision Tree  & 0.84 & 0.93 & 0.93 & 0.85\\
\hline
Bagging - &0.87 & 0.90 & 0.90  & 0.87\\
Decision  Tree  & & &  & \\
\hline
Boosting - &  0.89& 0.85 & 0.84  & 0.88 \\
Decision Tree  & & &  & \\
\hline
Decision Table  & 0.86 & 0.87 & 0.87  & 0.86\\
\hline
Nearest Neighbor  & 0.86  & 0.84  & 0.84  & 0.86 \\
\hline
Neural Networks  & 0.84 & 0.89 & 0.90  & 0.85\\
\hline
\end{tabular}
\caption{Performance of Classifiers - Data set consists of: (a)486 typosquatting domain certificates and
(b)486 non-typosquatting domain certificates (top Alexa's domain certificates, .com and .net random certificates)}
\label{tab:class-3}
\end{table}

\begin{table}[t]
\begin{tabular}{|c|c|c|c|c|}
\hline
Classifier & Positive & Positive & Negative & Negative\\
        & Recall & Precision & Recall & Precision\\
\hline
Random Forest & 0.95& 0.93 & 0.93  & 0.95\\
\hline
SVM  &  0.94 & 0.92  & 0.92& 0.94\\
\hline
Decision Tree  & 0.95 & 0.94 & 0.93  &0.95 \\
\hline
Bagging - & 0.96 & 0.94 & 0.93  &0.96 \\
Decision  Tree  & & &  & \\
\hline
Boosting - &0.98 & 0.90 & 0.90  & 0.97\\
Decision Tree  & & &  & \\
\hline
Decision Table  & 0.96 & 0.92 & 0.92  &0.96 \\
\hline
Nearest Neighbor  & 0.93  & 0.94  & 0.94  & 0.92 \\
\hline
Neural Networks  & 0.95& 0.95 & 0.95  &0.95 \\
\hline
\end{tabular}
\caption{Performance of Classifiers - Data set consists of: (a)486 typosquatting domain certificates
and (b)486 popular domain certificates (top Alexa's domain certificates)}
\label{tab:class-4}
\end{table}

\section{Discussion}\label{sec:discussion}
Based on the measurements presented in the previous sections,
we find that a significant percentage of well-known domains
\textit{already} use HTTPS (alongside HTTP), thus it is possible to harvest their certificates
for classifying them, without requiring any modifications from the domains' side.
Furthermore, the non-trivial portion of phishing web
sites using HTTPS highlights the need to analyze and correlate the
information provided in their server certificates.

\noindent\textbf{Limitations.}
We acknowledge that our data sets should be extended through longer observation periods.
Furthermore, additional data sets of legitimate domains need to be
taken into consideration, e.g. popular web sites from DNS logs in different organizations and countries.
Data sets of typosquatting domains can be strengthened by additional and more
effective name variations.
Also, we acknowledge that our phishing(typosquatting) classifier may incur false positives when actually
deployed. However, this is a common problem to many machine-learning-based mitigation solutions
(spam filtering and intrusion detections based on machine-learning algorithms) and the number of false
positives can be minimized by training the classifier on larger and more comprehensive data sets
(and continuing to do so for new samples). Our classifier does not provide a complete
standalone solution to the phishing(typosquatting) threat since many domains do not have HTTPS.
Instead, integrated with pre-existing solutions (e.g.,~\cite{wu2006,protectphish,learnphishemails}),
it improves their effectiveness in the context of
potentially critical applications enforcing HTTPS and it contributes to face a complete range of malicious domains.

Finally, we note that our classifier does not identify all kinds of typosquatting domains.
For instance, typo-domains displaying unexpected pages and ads might have no
incentive to use HTTPS, since they do not attempt to elicit private
information from users. However, in the case of a further increase of HTTPS usage,
our technique will be as a consequence increasing its effectiveness.
Generic typosquatting detection remains at the moment an interesting open issue that has not found effective solutions so far.

\noindent\textbf{Using information in certificates.}
Our results show significant differences between certificates
of legitimate domains and those of malicious domains. Not only is this information alone
sufficient to detect fraudulent activities as we have shown, but it is also a useful
component in assessing a web site's degree of trustworthiness, thus improving prior metrics, such
as~\cite{wu2006,protectphish,learnphishemails}. Our method should be integrated with other techniques
to improve the effectiveness of detecting malicious domains.

 \noindent\textbf{Keeping state of encountered certificates.}
We deliberately chose to conduct our measurements as general as possible, without relying on user
navigation history or on user specific training data. These components are fundamental
for most current mitigation techniques~\cite{learnphishemails,phoolproof}.
Moreover, we believe that  keeping track of navigation history is detrimental to user
privacy. However, our work yields effective detection by analyzing certain coarse-grained information extracted
from server certificates and not specific to a user's navigation patterns.
This is not privacy compromising as keeping fine-grained navigation history.

\if 0
For example, suppose
that a user misspells the domain name of her bank and ends up in a passive
phishing web site. It is quite likely that, in the phishing site's certificate,
several fields would be encountered
for the first time.
According to our measurements, this could be interpreted
as an indicator of fraud. As future work, we plan to consider an enhanced version of our classifier
assuming that it is possible to keep track of such privacy-insensitive information.
\fi

\noindent\textbf{How malicious domains will adapt.}
Web fraud detection is an arms race and Web-fraudsters are diligent and quickly adapt to new security
mechanisms and studies that threaten their business. We hope that this work will raise
the bar and make it more difficult for Web-fraudsters to deceive users.
If web-browsers use our
classifier and start analyzing SSL certificate fields in more detail, we expect
there will be two scenarios for web-fraudsters to adapt:
(1) to get legitimate certificates from CAs and leave a paper trail pointing to
"some person or organization" which is connected to such an activity, (2) to craft
certificates that have similar values like those that are the most common in those
of legitimate domains. Some fields/features will be easy to forge with legitimate values
(e.g., country of issuer, country of subject, subject common and organization name, validity period,
signature algorithm, serial number ...etc) but for some this will not be possible
(issuer name, signature ...etc) because otherwise the verification of
the certificate will fail. In either case the effectiveness of web-fraud will be reduced.

\section{Related Work}\label{sec:related}
The authors in \cite{ssl-crypt-strength} conducted a measurement study to measure the
cryptographic strength of more than 19,000 public servers running SSL/TLS. The study reported that
 many SSL sites still supported the weak SSL 2.0 protocol. Also, most of the probed servers
 supported DES, which is vulnerable to exhaustive search. Some of the sites used RSA-based
authentication with only 512-bit key size, which is insufficient. Nevertheless, the authors
showed encouraging measurement results such as the use of AES as default option for most of
the servers that did not support AES. Also, a trend toward using stronger cryptographic function
has been observed over two years of probing, despite a slow improvement. In \cite{ssl-priv-public},
the authors performed a six-month measurement study on the aftermath of the discovered vulnerability
in OpenSSL in May 2008, in order to measure how fast the hosts recovered from the bug and changed
their weak keys into strong ones.
Through the probing of thousands of servers, they showed that the replacement of the weak keys was
slow. Also, the speed of recovery was shown to be correlated to different SSL certificate characteristics
such as: CA type, expiry time, and key size. The article in \cite{ssl-survey-2000} presented a profiling
study of a set of SSL certificates.  Probing around  9,754  SSL servers and collecting 8,081 SSL certificates,
it found that  around 30\% of responding servers had weak security (small key size, supporting only SSL 2.0,...),
10\% of them were already expired and 3\% were  self-signed. Netcraft \cite{netcraft-survey} conducts a monthly
survey to measure the certificate validity of Internet servers. Recently, the study showed that 25\% of the
sites had their certificates self-signed and less than half had their certificates signed by valid CA. Symantec
\cite{symmantec-blog} has observed an increase in the number of URLs abusing SSL certificates. Only in the
period between May and June 2009, 26\% of all the SSL certificate attacks have been performed
by fraudulent domains using SSL certificates. Although our measurement study conducts a profiling of
SSL certificates, our purpose is different from the ones above. We analyze the certificates to show how
malicious certificates are different from benign ones and to leverage this difference in designing a mitigation technique.

The importance and danger of web-fraud (such as phishing and typosquatting)
has been recognized in numerous prior publications, studies and industry
reports mainly due to the tremendous financial losses
\cite{phishloss2007} that it causes. One notable study is \cite{spamscatter} which analyzed the
infrastructure used for hosting and supporting Internet scams, including
phishing. It used an opportunistic measurement technique that
mined email messages in real-time, followed the embedded
link structure, and automatically clustered destination web sites using image
shingling. In \cite{learnphishemails},  a machine learning based methodology was
proposed for detecting phishing email. The methodology was based on a classifier
that detected phishing with 96\% accuracy and false negative rate of 0.1\%. Our work
differs since it does not rely on phishing emails which are sometimes hard to identify.
An anti-phishing browser extension (AntiPhish) was given in \cite{protectphish}.
It kept track of sensitive information and warned the user whenever the user tried to
enter sensitive information into untrusted web sites. Our classifier
can be easily integrated with AntiPhish. However, AntiPhish compromised user privacy
by keeping state of sensitive data. Other anti-phishing proposals relied on trusted
devices, such as a user's cell phone in \cite{phoolproof}. In \cite{beyond-blacklists},
the authors tackled the problem of detecting malicious
web sites by only analyzing their URLs using machine-learning
statistical techniques on the lexical and host-based
features of their URLs. The proposed solution achieved a prediction
accuracy around 95\%. Other studies measured the extent of typosquatting and suggested
mitigation techniques. Wang, ed al.~\cite{Wang} showed that many
typosquatting domains were active and parked with a few parking services, which served
ads on them. Similarly, \cite{jaal} showed that, for nearly 57\% of original URLs considered,
over 35\% of all possible URL variations existed on the Internet. Surprisingly, over
99\% of such similarly-named web sites were considered phony. \cite{ads-portal-class} devised a methodology
for identifying ads-portals and parked domains and found out that around 25\% of (two-level)
.com and .net  domains were ads-portals and around 40\% of those were typosquatting.
McAfee also studied the typosquatting problem in~\cite{mcafeestudy}. A set of 1.9 million
single-error typos was generated and  $127,381$ suspected typosquatting domains
were discovered. Alarmingly, the study also found that typosquatters targeted children-oriented domains.
Finally, McAfee added to its extension site advisor~\cite{siteadvisor}  some
capabilities for identifying typosquatters.

User studies analyzing the effectiveness of browser warning messages indicated that an
overwhelming percentage (up to 70-80\% in some cases) of users ignored them. This
observation---confirmed by recent research results (e.g., \cite{ssl-usability}
and \cite{been-warned-ssl})--- might explain the unexpected high percentage of expired and
self signed certificates that we found in the results  of all our data sets.
In \cite{perspectives}, the authors proposed a solution to simplify the process
(for the users) of authenticating the servers' public keys (or SSL certificates)
by deploying a set of semi-trusted collection of network servers that continuously
probed the servers and collected their public keys (or SSL certificates). When the
user was exposed to a new public key (SSL certificate), he referred to these
semi-trusted servers to verify the authenticity of public keys (SSL certificates).

We conclude that, to the best of our knowledge, no prior work has explored the web-fraud problem
in the context of HTTPS and proposed analyzing server-side SSL certificates in more detail.
Our work yields a detailed analysis of SSL certificates from different domain families and a
classifier that detects web-fraud domains based on their certificates.

\section{Conclusion}\label{sec:conclusion}
In this paper, we study the prevalence of HTTPS usage in popular and
legitimate domains as well as in the
context of web-fraud, i.e., phishing and typosquatting.
To the best of our knowledge, this is the first effort to analyze
information in SSL certificates to profile domains and
assess their degree of trustworthiness.
We design and build a machine-learning-based
classifier that identifies fraudulent domains using HTTPS
based solely on their SSL certificates, thus also preserving user privacy.
Our work can be integrated with  pre-exisiting detection techniques to
improve their effectiveness in the context of
potentially critical applications enforcing HTTPS.
Finally, we believe that our results may serve as a motivating factor
to increase the use of HTTPS on the Web, showing that
besides  its intended benefits of confidentiality and authenticity, the use of
HTTPS can help identifying web-fraud domains.

\footnotesize{
\bibliographystyle{abbrv}