AntiPhishingEngine

1. Overview

The AntiPhishingEngine is a lightweight, user-space phishing detection engine designed to detect malicious or suspicious URLs using a combination of static blacklist matching and heuristic pattern analysis.

The engine is implemented in modern C++ and is intended to run as a background worker thread. It integrates with GTKmm-based applications through sigc++ signals for real-time event notification and user feedback.

This component is intentionally simple and deterministic, serving as a first-line filter that can later be extended with external feeds, browser hooks, or network-level inspection.

2. Initialization and Blacklist Loading

Upon construction, the engine resolves the phishing blacklist path using the resource() helper to ensure correct runtime file location across installed and development environments.

phishing/blacklist.txt

The blacklist file is loaded line-by-line into an in-memory vector. Empty lines are ignored.

Initialization behavior:

  • If the file cannot be opened, a localized warning is printed to stderr
  • If the file is empty, a warning is emitted
  • If entries are loaded successfully, the number of loaded rules is logged

The engine remains operational even if the blacklist is missing or empty, allowing heuristic detection to continue functioning.

3. Thread Lifecycle Management

3.1 Start / Stop Semantics

The engine runs its background logic inside a dedicated worker thread. Thread execution is controlled by an atomic-style boolean flag (running_).

  • start() – launches the worker thread if not already running
  • stop() – signals termination and joins the thread safely

The destructor automatically invokes stop() to guarantee clean shutdown and prevent orphaned threads.

3.2 Background Loop

The run() method represents the engine main loop. Currently, it acts as a placeholder for future integrations (browser logs, network events, filesystem monitoring).

  • Emits a localized “started” event when the loop begins
  • Runs a sleep-based loop with a 30-second interval
  • Emits a localized “stopped” event on termination

All lifecycle events are propagated via GTK-safe signal emission.

4. URL Inspection Pipeline

4.1 Public Entry Point

The primary inspection method is:

bool check_url(const std::string& url)

The method applies a deterministic evaluation pipeline:

  1. Blacklist match check
  2. Heuristic phishing pattern analysis

If a match is detected at any stage, a warning event is emitted and the method returns true.

4.2 Blacklist Matching

Blacklist detection is implemented as a simple substring match against all loaded blacklist entries:

  • No DNS resolution is performed
  • No regex is used for blacklist matching (intentional for performance)
  • Matches are case-sensitive, reflecting the source list

This approach favors speed and predictability over deep URL parsing.

4.3 Heuristic Phishing Detection

A minimal heuristic layer detects visually deceptive domains using common character substitution techniques (homoglyph attacks).

Currently implemented patterns include:

  • g00gle
  • faceb00k
  • paypa1
  • micros0ft

Detection is implemented via a precompiled std::regex and is intentionally conservative to minimize false positives.

5. Event Signaling and UI Integration

The engine exposes a signal interface for real-time notifications:

sigc::signal<void(const std::string&)>

Events are emitted for:

  • Engine startup
  • Engine shutdown
  • Blacklist detections
  • Heuristic phishing detections

All emitted messages are localized using glib/gi18n, allowing seamless internationalization in GTK-based applications.

6. Security and Design Considerations

  • User-space execution: no elevated privileges are required
  • Fail-safe behavior: missing blacklist does not disable the engine
  • Thread safety: controlled shutdown and join semantics
  • Extensibility: designed to support future log, browser, or network hooks
  • Low attack surface: no dynamic code execution or external parsing

The AntiPhishingEngine intentionally prioritizes simplicity, predictability, and UI transparency, making it suitable as both a standalone detection layer and a building block for more advanced phishing defenses.

Published on:
Last updated on: