QRïS: A Preemptive Novel Method for Quishing Detection Through Structural Features of QR

TL;DR

This paper introduces QRï̈S, a transparent preemptive method for detecting Quishing by analyzing 24 structural features of QR codes rather than decoding embedded content. It builds two large synthetic datasets (Feat-DataSet-1 and Feat-DataSet-2) derived from public URL corpora and trains light-weight models (XGBoost and Random Forest) on these features, achieving up to 83.18% accuracy and 0.912 AUC. The authors emphasize interpretability, provide case-based explanations of predictions, and validate practicality through a Flutter-based mobile app with a public codebase. The work offers a scalable, privacy-preserving alternative to content-based QR security approaches and lays the groundwork for deployment in real-world scanning workflows.

Abstract

Globally, individuals and organizations employ Quick Response (QR) codes for swift and convenient communication. Leveraging this, cybercriminals embed falsify and misleading information in QR codes to launch various phishing attacks which termed as Quishing. Many former studies have introduced defensive approaches to preclude Quishing such as by classifying the embedded content of QR codes and then label the QR codes accordingly, whereas other studies classify them using visual features (i.e., deep features, histogram density analysis features). However, these approaches mainly rely on black-box techniques which do not clearly provide interpretability and transparency to fully comprehend and reproduce the intrinsic decision process; therefore, having certain obvious limitations includes the approaches' trust, accountability, issues in bias detection, and many more. We proposed QRïS, the pioneer method to classify QR codes through the comprehensive structural analysis of a QR code which helps to identify phishing QR codes beforehand. Our classification method is clearly transparent which makes it reproducible, scalable, and easy to comprehend. First, we generated QR codes dataset (i.e. 400,000 samples) using recently published URLs datasets [1], [2]. Then, unlike black-box models, we developed a simple algorithm to extract 24 structural features from layout patterns present in QR codes. Later, we train the machine learning models on the harvested features and obtained accuracy of up to 83.18%. To further evaluate the effectiveness of our approach, we perform the comparative analysis of proposed method with relevant contemporary studies. Lastly, for real-world deployment and validation, we developed a mobile app which assures the feasibility of the proposed solution in real-world scenarios which eventually strengthen the applicability of the study.

Figures (11)

• Figure 1: An example anatomy of Version 2 QR code. Every QR code consists of two segments that are composed of 9 different regions. These regions represents various information that can be used as features of QR codes.
• Figure 2: A general understanding of differentiation between QR codes. (a) represents a legitimate and (b) represents a phishing QR codes. Both QR codes have clear difference in their in-built structural features.
• Figure 3: An overview of utilizing URLs datasets and converting them in to synthetic QR codes. This process involves multiple preliminary checks to ensure smooth generation of QR codes. Afterwards, these QR codes are fed into a systematic approach which extract protocol-level and statistical features and saving in a CSV file.
• Figure 4: Example of capturing protocol-level features of QR codes: (a) Version: calculating total modules, (b) ECC level and masking pattern: found in 15-bits format information, (c) Number of alignment patterns: found in specific positions, (d) Required remainder bits: usually not present in every QR code.
• Figure 5: A high-level architecture of QRı̈S framework. This includes capturing the QR code image while user scanning the QR code. After copping the QR code part, further pre-processing steps are applied to make it clean before extracting structural features. An example of 24 extracted features is also presented, which later fed in to trained ML models (XGBoost and RF) to make the final prediction.