Secure Real-Time Computational Intelligence System Against Malicious QR Code Links
Keywords:
QR Codes, Barcode Scanners, Malicious Links, Real-Time, Computational IntelligenceAbstract
Web attackers aim to propagate malicious links using various techniques to deceive users. They attempt to control victims’ devices or obtain their passwords remotely, thereby acquiring access to bank accounts, financial transactions, or private and sensitive information they trade via the Internet. QR codes are accessible, free, easy to use, and can be scanned through several free apps on smartphones. As there is no standard structure or authentication phase in QR code generation, such codes are vulnerable to suspicious online content embedding, i.e., phishing, Cross-Site Scripting (XSS), and malware. Many studies have highlighted the attacks that may be perpetrated using barcodes, and there are some security countermeasures. Several of these solutions are limited to malicious link detection methods or require knowledge of cryptographic techniques. This study’s main objective is to detect malicious URLs embedded in QR codes. A dataset of 90 000 benign and malicious URLs was collected from various resources, and their lexical properties were extracted. Two computational intelligence models, fuzzy logic and multilayer perceptron artificial neural network (MLP-ANN), were applied and compared. An MLP-ANN was identified as the best classifier for detecting malicious URLs, and a proactive, secure, real-time computational intelligence barcode scanner implementation (BarCI ) against malicious QR code links was proposed based on this classifier. The results demonstrate that this approach enables efficient real-time attack detection with 82.9% accuracy
References
[2] Akta, C. (2017). The Evolution and Emergence of QR Codes, Cambridge Scholars Publishing: United Kingdom, 2017.
[3] Wahsheh, H. A. M. (2019). Secure and Usable QR Codes, PhD thesis, Universita Ca Foscari Venezia: Italy, 2019.
[4] [Online]. Available: https://www.iso.org/standard/62021.html, Accessed on 10 December 2020.
[5] Uzun, V.; Bilgin, S. (2016). Evaluation and implementation of QR Code Identity Tag system for Healthcare in Turkey, SpringerPlus, 5, 1-24, 2016. https://doi.org/10.1186/s40064-016-3020-9
[6] Focardi, R.; Luccio, F. L.; Wahsheh, H. A. M. (2018). Security Threats and Solutions for Two Dimensional Barcodes: A Comparative Study, In K. Daimi (Ed.), Computer and Network Security Essentials, Springer, 207-219, 2018. https://doi.org/10.1007/978-3-319-58424-9_12
[7] Wahsheh, H.A.; Luccio, F.L. (2020). Security and Privacy of QR Code Applications: A Comprehensive Study, General Guidelines and Solutions, Information, 11(4), 1-23, 2020. https://doi.org/10.3390/info11040217
[8] Ukrop, M.; Kraus, L.; Matyas, V.; Wahsheh, H.A.M. (2019). Will you trust this TLS certificate? perceptions of people working in IT, Proceedings of the 35th Annual Computer Security Applications Conference,718-731, 2019. https://doi.org/10.1145/3359789.3359800
[9] Vidas, T.; Owusu, E.; Wang, S.; Zeng, C.; Cranor, L.; Christin, N. (2013). QRishing : The Susceptibility of Smartphone Users to QR Code Phishing Attacks, Proc. of FC'13, LNCS, Springer, 7862, 52-69,2013. https://doi.org/10.1007/978-3-642-41320-9_4
[10] Dabrowski, A.; Krombholz, K.; Ullrich, J.; Weippl, E. (2014). QR Inception: Barcode-in-Barcode Attacks, Proceedings of the 4th ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM'14),Scottsdale, Arizona, USA, 3-10, 2014. https://doi.org/10.1145/2666620.2666624
[11] Kharraz, A.; Kirda, E.; Robertson, W.; Balzarotti, D.; Francillon, A. (2014). Optical Delusions: A Study of Malicious QR Codes in the Wild. Proc. of IEEE/IFIP DSN'14, 192-203, 2014. https://doi.org/10.1109/DSN.2014.103
[12] Focardi, R.; Luccio, F. L.; Wahsheh, H.A.M. (2018). Usable Cryptographic QR Codes, Proceedings of the 19th International Conference on Industrial Technology, IEEE, 1664-1669, 2018. https://doi.org/10.1109/ICIT.2018.8352431
[13] Focardi, R.; Luccio, F. L.; Wahsheh, H.A.M. (2019). Usable Security for QR Code. Journal of Information Security and Applications, Journal of Information Security and Applications, 48(4), 1-9, 2019. https://doi.org/10.1016/j.jisa.2019.102369
[14] Ishihara, T.; Niimi, M. (2014). Compatible 2D-code Having Tamper Detection System with QRcode, Proc. of the IIHMSP'14, IEEE, 493-496, 2014. https://doi.org/10.1109/IIH-MSP.2014.129
[15] Song, J.; Gao, K.; Shen, X.; Qi, X.; Liu, R.; Choo, K.K.R. (2018). QRFence: A flexible and scalable QR link security detection framework for Android devices, Future Generation Computer Systems, 88, 663-674, 2018. https://doi.org/10.1016/j.future.2018.05.082
[16] [Online]. Available: https://www.phishtank.com, Accessed on 10 December 2020.
[17] [Online]. Available: https://Malware-domains.com/files, Accessed on 10 December 2020.
[18] [Online]. Available: https://www. kdnuggets.com/2016/10/machine-learning-detect-maliciousurls. html, Accessed on 10 December 2020.
[19] Wahsheh, H. A.; Al-Kabi, M. N.; Alsmadi, I. M. (2013). A link and content hybrid approach for Arabic web spam detection, International Journal of Intelligent Systems and Applications (IJISA), 5, 30-43, 2013. https://doi.org/10.5815/ijisa.2013.01.03
[20] Al-Kabi, M. N.; Wahsheh, H. A.; Alsmadi, I. M. (2013). OLAWSDS: An Online Arabic Web Spam Detection System, International Journal of Advanced Computer Science & Applications, 5, 105-110, 2014.
[21] [Online]. Available: https://data.world/crowdflower/urlcategorization, Accessed on 12 December 2020.
[22] [Online]. Available: https://www.searchenginejournal.com/ website-taxonomy/361348/, Accessed on 12 December 2020.
[23] [Online]. Available: .https: //tinyurl.com/ website-taxonomy/361348/, Accessed on 12 December 2020.
[24] Joshi, A.; Lloyd, L.; Westin, P. (2019). Using Lexical Features for Malicious URL Detection-A Machine Learning Approach, arXiv preprint.
[25] Wu, H.; Xu, Z.S. (2021). Fuzzy Logic in Decision Support: Methods, Applications and Future Trends, International Journal of Computers Communications & Control, 16(1), 4044, 2021. https://doi.org/10.15837/ijccc.2021.1.4044
[26] Shi, Y. (2021). My Early Researches on Fuzzy Set and Fuzzy Logic,International Journal of Computers Communications & Control, 16(1), 4090, 2021. https://doi.org/10.15837/ijccc.2021.1.4090
[27] Odeh, A.; Alarbi, A.; Keshta, I.; Abdelfattah, E. (2020) Efficient Prediction Of Phishing Websites Using Multilayer Perceptron (Mlp), Journal of Theoretical and Applied Information Technology, 98, 2020. https://doi.org/10.3991/ijim.v14i11.13903
[28] Witten, I.H.; Frank, E.; Mark, A. Hall, and Christopher J Pal. (2016). Data Mining: Practical machine learning tools and techniques, Morgan Kaufmann, 2016.
[29] [Online]. Available: https://github.com/zxing/zxing/, Accessed on 12 December 2020.
[30] Wahsheh, H.; Luccio, F. (2019). Evaluating Security, Privacy and Usability Features of QR Code Readers, Proceedings of the 5th International Conference on Information Systems Security and Privacy (ICISSP 2019), SciTePress, 266-273. 2019. https://doi.org/10.5220/0007346202660273
Additional Files
Published
Issue
Section
License
ONLINE OPEN ACCES: Acces to full text of each article and each issue are allowed for free in respect of Attribution-NonCommercial 4.0 International (CC BY-NC 4.0.
You are free to:
-Share: copy and redistribute the material in any medium or format;
-Adapt: remix, transform, and build upon the material.
The licensor cannot revoke these freedoms as long as you follow the license terms.
DISCLAIMER: The author(s) of each article appearing in International Journal of Computers Communications & Control is/are solely responsible for the content thereof; the publication of an article shall not constitute or be deemed to constitute any representation by the Editors or Agora University Press that the data presented therein are original, correct or sufficient to support the conclusions reached or that the experiment design or methodology is adequate.
