PhishChain: A Decentralized and Transparent System to Blacklist Phishing URLs

TL;DR

PhishChain introduces a decentralized, transparent blockchain-based system for blacklisting phishing URLs, enhancing security by removing central authority reliance and ensuring immutable, crowd-sourced verification of malicious sites.

Contribution

The paper presents a novel blockchain system with a page rank based algorithm for transparent, decentralized phishing URL blacklisting, including a user incentive mechanism.

Findings

Blockchain ensures transparency and decentralization.

Page rank algorithm effectively assesses phishing URLs.

User participation incentivized with skill points.

Abstract

Blacklists are a widely-used Internet security mechanism to protect Internet users from financial scams, malicious web pages and other cyber attacks based on blacklisted URLs. In this demo, we introduce PhishChain, a transparent and decentralized system to blacklisting phishing URLs. At present, public/private domain blacklists, such as PhishTank, CryptoScamDB, and APWG, are maintained by a centralized authority, but operate in a crowd sourcing fashion to create a manually verified blacklist periodically. In addition to being a single point of failure, the blacklisting process utilized by such systems is not transparent. We utilize the blockchain technology to support transparency and decentralization, where no single authority is controlling the blacklist and all operations are recorded in an immutable distributed ledger. Further, we design a page rank based truth discovery algorithm to assign a phishing score to each URL based on crowd sourced assessment of URLs. As an incentive for voluntary participation, we assign skill points to each user based on their participation in URL verification.