The Phisherman Project: Creating a Comprehensive Data Collection to Combat Phishing Attacks
Gregg W. Tally, D. Sames, Tom Chen, Chris Colleran, David Jevans, Kevin Omiliak, Rod Rasmussen · Journal of Digital Forensic Practice · 2006
The Phisherman project is developing a real-time phishing data collection, validation, dissemination, and archival system. The objectives are to rapidly provide reliable data from on-going attacks to first responders and brand owners and to collect comprehensive data for researchers and law enforcement. Working with the Anti-Phishing Working Group, the project is enlisting the support of several industry partners already actively involved in phishing data collection. There are several proprietary and specialized data collection efforts underway. The Phisherman project is working to merge the existing data collections into a global data collection system. As an investigative tool, Phisherman will provide a reliable, searchable database of phishing incident reports, including email, data collection sites, and malware, as well as analysis and historical records of attacks. All data entering the Phisherman system will pass through two stages of automated verification to provide a confidence rating on the incident report. As new incidents are posted to the repository, the system will identify similarities between the new incident report and existing reports. A relational database will link potentially related attacks through common characteristics of attack methods. By recording data on nearly identical attacks, the repository will help identify the scope of the attack and potential victims.