# Application of Workflow Technology for Big Data Analysis Service
## 3 Case Study
### Phishing Site Discovery  
Phishing websites steal users' accounts and passwords by masquerading as bank or e-commerce websites. Phishing websites usually spread through e-mail, in which a disguised link connects the recipient to a phishing website. The page of the phishing website is almost exactly the same as the real web interface, which asks the visitor to provide an account and a password. In general, a phishing website structure is simple; it only has one or several pages, and the Uniform Resource Locator (URL) is slightly different from the real website. Once a user is tricked by the phishing website, it causes the disclosure of user information and actual property damage. Effective identification of phishing sites can avoid losses for users. Domain Name System (DNS) is a distributed database of domain names and Internet Protocol (IP) addresses mapped to each other, thereby enabling users to access  
Figure 14: Customer churn prediction (CCP).  
Figure 15: Sequence Diagram of CCP.  
the Internet conveniently. We can model the static and dynamic characteristics of DNS traffic through the big-data analysis of the DNS system's traffic and logs, which can effectively identify phishing sites. DNS packet characteristics are extracted, including the length of DNS package, DNS responding time, sending frequency, domain name dispersion, IP dispersion, recursive path, and domain lifetime. An anomaly behavior model is constructed on the basis of the DNS packet characteristics to detect phishing domain names. DNS-based phishing website discovery is divided into two steps: offline model training and online real-time discovery.  
Offline model training: Offline analysis employs the MapReduce computing framework. User behavior features (e.g., malicious fast flux duration, domain name and timestamp, and the survival time of DNS response) are extracted from large amounts of DNS requests and response information, and a phishing website classification model is established on the basis of the marked training set (as shown in Figure 16). This model is effective against phishing website variants that can serve for phishing websites discovery, warning, handling, and sharing.  
Real-time discovery: The phishing website discovery model is implemented in the DNS server. The model can detect and filter users' network access information in real-time on the basis of the streaming computing framework Storm, which would not generate extra impacts on users. Users' real-time HTTP (Hypertext Transfer Protocol) and DNS requests information is integrated into the phishing website discovery model. The model can detect whether the request is a phishing website in a short period of time. Figure 17 shows the workflow in the ChainWF model. The detailed discovery process is illustrated in Figure 18.  
Figure 16: The process of phishing site discovery. DNS: Domain Name System; ISP: internet service provider; URL: Uniform Resource Locator; SVM: Support Vector Machine.  
Figure 17: Online stream classification model: (**a**) Off-line batch model training; (**b**) Online real-time identification intercept.  
Figure 18: “Phishing website” analysis sequence diagram.