Loading article...
Loading article...
Stream/Area:
-
Subject:
-
Paper ID:
IJSREM68328
Volume:
10 |
10 |
Oct 2026
Pages:
1-6
Publication Frequency:
Monthly (12 issues per year)
License:International Journal of Scientific Research in Engineering and Management follows the Creative Commons Attribution 4.0 (CC BY 4.0) License, allowing free use and distribution with proper attribution.
Electronics and Telecommunication
Priyadarshini College of Engineering
Electronics and Telecommunication
Priyadarshini College of Engineering
Electronics and Telecommunication
Priyadarshini College of Engineering
Electronics and Telecommunication
Priyadarshini College of Engineering
A QR code is just a printed pattern, so a person scanning one has no way to tell where it will lead, and QR codes now carry payments, web links and login prompts. Quishing, meaning phishing delivered through QR codes, takes advantage of this by steering people to fake pages, executable downloads or altered UPI payment requests. We built a prototype that examines what a QR code actually contains instead of simply decoding it. An uploaded image passes through several OpenCV preprocessing steps, with ZBar and ZXing-C++ available as optional backup decoders. From the recovered payload, 23 security features are computed in six groups: payload metrics, protocol and host, lexical counts, domain characteristics including Shannon entropy, malware and phishing indicators, and UPI parameters. A Random Forest classifier with 450 trees, a maximum depth of 12 and balanced class weights then estimates how likely the payload is to be malicious. That probability is blended with rule-based penalties to give a QR Risk Score between 0 and 100, which maps to Safe, Medium Risk or High Risk and appears alongside plain-language warnings. Every scan is stored in SQLite and can be reviewed in a Streamlit dashboard. We evaluated on a stratified 80:20 split of a labelled dataset of 450 payloads (295 safe, 155 malicious); the classifier reached 98.89% test accuracy, making one error among 90 test payloads, and five-fold cross-validation gave 100%. These figures should be read as optimistic. In this dataset every safe URL uses HTTPS and every malicious URL uses HTTP, many payloads follow repeated templates, and the two classes remain perfectly separable even after the protocol features or the repeated rows are removed. A supplementary test on 80,000 URLs from a larger collection supports this caution: the same model scored 86.3% accuracy and missed about 27% of the malicious URLs. The results show that the pipeline works from end to end but say little about real-world performance, and larger, more realistic datasets with independent testing are needed before stronger claims can be made.
KEYWORDS
This paper presented a prototype that analyses QR payloads for security risk. It addresses the fact that a QR image reveals nothing about its destination and that ordinary scanners decode without judging. The prototype combines multi-pass decoding with OpenCV and optional ZBar and ZXing-C++ fallbacks, 23 payload-based features, a Random Forest classifier, rule-based penalties, a 0–100 QR Risk Score with three levels, readable warnings, SQLite logging and a Streamlit dashboard. The classifier reached 98.89% test accuracy and 100% in five-fold cross-validation on a dataset of 450 payloads, but the data are templated and easy to separate, and a supplementary check on 80,000 URLs gave only 86.3% for the same model. This shows that the pipeline works end to end, not how it would perform against real QR threats. The system is an aid that helps a user pause before opening a link or paying, not a guarantee against fraud. Future work should focus on a larger, more realistic dataset with proper validation and on external reputation and merchant-verification data.
[1] A. Kharraz, E. Kirda, W. Robertson, D. Balzarotti, and A. Francillon, “Optical delusions: A study of malicious QR codes in the wild,” in Proc. 44th Annu. IEEE/IFIP Int. Conf. Dependable Syst. Netw. (DSN), 2014, pp. 192–203. [2] M. A. Ozuberk and I. Cinar, “Malicious QR code classification using machine learning, deep learning, and explainable AI,” in Proc. 2026 5th Int. Informatics and Software Engineering Conf. (IISEC), Ankara, Türkiye, 2026, pp. 128–133, doi: 10.1109/IISEC69317.2026.11418433. [3] N. N. Ahamed, T. Murugan, and B. K. Mohanta, “QR code phishing (quishing): Food supply chain management traceability risks combined with blockchain technology,” in Proc. 2025 3rd Int. Conf. Business Analytics for Technology and Security (ICBATS), 2025. [4] A. S. Rafsanjani, N. B. Kamaruddin, H. M. Rusli, and M. Dabbagh, “QsecR: Secure QR code scanner according to a novel malicious URL detection framework,” IEEE Access, vol. 11, pp. 92523–92539, 2023, doi: 10.1109/ACCESS.2023.3291811. [5] J. Ma, L. K. Saul, S. Savage, and G. M. Voelker, “Beyond blacklists: Learning to detect malicious web sites from suspicious URLs,” in Proc. 15th ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining (KDD), Paris, France, 2009, pp. 1245–1254. [6] C. E. Shannon, “A mathematical theory of communication,” Bell Syst. Tech. J., vol. 27, no. 3, pp. 379–423, Jul. 1948. [7] L. Breiman, “Random forests,” Mach. Learn., vol. 45, no. 1, pp. 5–32, 2001. [8] F. Pedregosa et al., “Scikit-learn: Machine learning in Python,” J. Mach. Learn. Res., vol. 12, pp. 2825–2830, 2011.
Publication Date
10/26/2026
Peer Review Type
Double-Blind Peer Review
Review Rounds: 2
Documents
Article Views
1
Total views since publication
PDF Downloads
7
Total downloads since publication
Geographic Reach
5
Digital Preservation: This article is permanently archived on Zenodo and complies with all data preservation standards across major indexing platforms.
Plagiarism Screening
This manuscript has been checked for plagiarism using TurnitinPlagiarismChecker software.
Conflict of Interest
The authors declare no conflict of interest related to this research work.
Funding Information
No funding information available for this research.
Related research in the same subject area
Loading similar articles...