Secure Real-Time Computational Intelligence System Against Malicious QR Code Links

Authors

  • Heider A. M. Wahsheh King Faisal University
  • Mohammed S. Al-Zahrani King Faisal University

Keywords:

QR Codes, Barcode Scanners, Malicious Links, Real-Time, Computational Intelligence

Abstract

Web attackers aim to propagate malicious links using various techniques to deceive users. They attempt to control victims’ devices or obtain their passwords remotely, thereby acquiring access to bank accounts, financial transactions, or private and sensitive information they trade via the Internet. QR codes are accessible, free, easy to use, and can be scanned through several free apps on smartphones. As there is no standard structure or authentication phase in QR code generation, such codes are vulnerable to suspicious online content embedding, i.e., phishing, Cross-Site Scripting (XSS), and malware. Many studies have highlighted the attacks that may be perpetrated using barcodes, and there are some security countermeasures. Several of these solutions are limited to malicious link detection methods or require knowledge of cryptographic techniques. This study’s main objective is to detect malicious URLs embedded in QR codes. A dataset of 90 000 benign and malicious URLs was collected from various resources, and their lexical properties were extracted. Two computational intelligence models, fuzzy logic and multilayer perceptron artificial neural network (MLP-ANN), were applied and compared. An MLP-ANN was identified as the best classifier for detecting malicious URLs, and a proactive, secure, real-time computational intelligence barcode scanner implementation (BarCI ) against malicious QR code links was proposed based on this classifier. The results demonstrate that this approach enables efficient real-time attack detection with 82.9% accuracy

References

[1] [Online]. Available: . http://www.qrcode.com/en, Accessed on 14 December 2020.

[2] Akta, C. (2017). The Evolution and Emergence of QR Codes, Cambridge Scholars Publishing: United Kingdom, 2017.

[3] Wahsheh, H. A. M. (2019). Secure and Usable QR Codes, PhD thesis, Universita Ca Foscari Venezia: Italy, 2019.

[4] [Online]. Available: https://www.iso.org/standard/62021.html, Accessed on 10 December 2020.

[5] Uzun, V.; Bilgin, S. (2016). Evaluation and implementation of QR Code Identity Tag system for Healthcare in Turkey, SpringerPlus, 5, 1-24, 2016. https://doi.org/10.1186/s40064-016-3020-9

[6] Focardi, R.; Luccio, F. L.; Wahsheh, H. A. M. (2018). Security Threats and Solutions for Two Dimensional Barcodes: A Comparative Study, In K. Daimi (Ed.), Computer and Network Security Essentials, Springer, 207-219, 2018. https://doi.org/10.1007/978-3-319-58424-9_12

[7] Wahsheh, H.A.; Luccio, F.L. (2020). Security and Privacy of QR Code Applications: A Comprehensive Study, General Guidelines and Solutions, Information, 11(4), 1-23, 2020. https://doi.org/10.3390/info11040217

[8] Ukrop, M.; Kraus, L.; Matyas, V.; Wahsheh, H.A.M. (2019). Will you trust this TLS certificate? perceptions of people working in IT, Proceedings of the 35th Annual Computer Security Applications Conference,718-731, 2019. https://doi.org/10.1145/3359789.3359800

[9] Vidas, T.; Owusu, E.; Wang, S.; Zeng, C.; Cranor, L.; Christin, N. (2013). QRishing : The Susceptibility of Smartphone Users to QR Code Phishing Attacks, Proc. of FC'13, LNCS, Springer, 7862, 52-69,2013. https://doi.org/10.1007/978-3-642-41320-9_4

[10] Dabrowski, A.; Krombholz, K.; Ullrich, J.; Weippl, E. (2014). QR Inception: Barcode-in-Barcode Attacks, Proceedings of the 4th ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM'14),Scottsdale, Arizona, USA, 3-10, 2014. https://doi.org/10.1145/2666620.2666624

[11] Kharraz, A.; Kirda, E.; Robertson, W.; Balzarotti, D.; Francillon, A. (2014). Optical Delusions: A Study of Malicious QR Codes in the Wild. Proc. of IEEE/IFIP DSN'14, 192-203, 2014. https://doi.org/10.1109/DSN.2014.103

[12] Focardi, R.; Luccio, F. L.; Wahsheh, H.A.M. (2018). Usable Cryptographic QR Codes, Proceedings of the 19th International Conference on Industrial Technology, IEEE, 1664-1669, 2018. https://doi.org/10.1109/ICIT.2018.8352431

[13] Focardi, R.; Luccio, F. L.; Wahsheh, H.A.M. (2019). Usable Security for QR Code. Journal of Information Security and Applications, Journal of Information Security and Applications, 48(4), 1-9, 2019. https://doi.org/10.1016/j.jisa.2019.102369

[14] Ishihara, T.; Niimi, M. (2014). Compatible 2D-code Having Tamper Detection System with QRcode, Proc. of the IIHMSP'14, IEEE, 493-496, 2014. https://doi.org/10.1109/IIH-MSP.2014.129

[15] Song, J.; Gao, K.; Shen, X.; Qi, X.; Liu, R.; Choo, K.K.R. (2018). QRFence: A flexible and scalable QR link security detection framework for Android devices, Future Generation Computer Systems, 88, 663-674, 2018. https://doi.org/10.1016/j.future.2018.05.082

[16] [Online]. Available: https://www.phishtank.com, Accessed on 10 December 2020.

[17] [Online]. Available: https://Malware-domains.com/files, Accessed on 10 December 2020.

[18] [Online]. Available: https://www. kdnuggets.com/2016/10/machine-learning-detect-maliciousurls. html, Accessed on 10 December 2020.

[19] Wahsheh, H. A.; Al-Kabi, M. N.; Alsmadi, I. M. (2013). A link and content hybrid approach for Arabic web spam detection, International Journal of Intelligent Systems and Applications (IJISA), 5, 30-43, 2013. https://doi.org/10.5815/ijisa.2013.01.03

[20] Al-Kabi, M. N.; Wahsheh, H. A.; Alsmadi, I. M. (2013). OLAWSDS: An Online Arabic Web Spam Detection System, International Journal of Advanced Computer Science & Applications, 5, 105-110, 2014.

[21] [Online]. Available: https://data.world/crowdflower/urlcategorization, Accessed on 12 December 2020.

[22] [Online]. Available: https://www.searchenginejournal.com/ website-taxonomy/361348/, Accessed on 12 December 2020.

[23] [Online]. Available: .https: //tinyurl.com/ website-taxonomy/361348/, Accessed on 12 December 2020.

[24] Joshi, A.; Lloyd, L.; Westin, P. (2019). Using Lexical Features for Malicious URL Detection-A Machine Learning Approach, arXiv preprint.

[25] Wu, H.; Xu, Z.S. (2021). Fuzzy Logic in Decision Support: Methods, Applications and Future Trends, International Journal of Computers Communications & Control, 16(1), 4044, 2021. https://doi.org/10.15837/ijccc.2021.1.4044

[26] Shi, Y. (2021). My Early Researches on Fuzzy Set and Fuzzy Logic,International Journal of Computers Communications & Control, 16(1), 4090, 2021. https://doi.org/10.15837/ijccc.2021.1.4090

[27] Odeh, A.; Alarbi, A.; Keshta, I.; Abdelfattah, E. (2020) Efficient Prediction Of Phishing Websites Using Multilayer Perceptron (Mlp), Journal of Theoretical and Applied Information Technology, 98, 2020. https://doi.org/10.3991/ijim.v14i11.13903

[28] Witten, I.H.; Frank, E.; Mark, A. Hall, and Christopher J Pal. (2016). Data Mining: Practical machine learning tools and techniques, Morgan Kaufmann, 2016.

[29] [Online]. Available: https://github.com/zxing/zxing/, Accessed on 12 December 2020.

[30] Wahsheh, H.; Luccio, F. (2019). Evaluating Security, Privacy and Usability Features of QR Code Readers, Proceedings of the 5th International Conference on Information Systems Security and Privacy (ICISSP 2019), SciTePress, 266-273. 2019. https://doi.org/10.5220/0007346202660273

Additional Files

Published

2021-05-09

Most read articles by the same author(s)

Obs.: This plugin requires at least one statistics/report plugin to be enabled. If your statistics plugins provide more than one metric then please also select a main metric on the admin's site settings page and/or on the journal manager's settings pages.