Building a Predictive Pipeline to Rapidly Detect Phishing Domains presented at BSidesVancouver 2018

by Wes Connell,

Summary : Registering a new domain, requesting an SSL certificate, and installing it on the server got much cheaper for threat actors thanks to the LetsEncrypt Certificate Authority. Detecting new phishing domains has always been a reactive process for security teams; just like malware, one cannot provide threat intelligence on phishing domains before they're registered and operationalized.The development of the Certificate Log Transparency network adds an interesting dimension for how this process can be improved. SSL certificates, and the domains for which they are issued, can now be monitored in real-time. Security analysts have intuition on what a phishing domain looks like when they see it. Building a predictive pipeline to detect SSL certificates issued to new phishing domains can be accomplished very simply using supervised machine learning. In this talk, I'll introduce a Python-based framework for building this predictive pipeline from scratch.