A Review of Factors Affecting the Effectiveness of Phishing

Robert Karamagi

doi:10.5539/cis.v15n1p20

Abstract

Phishing has become the most convenient technique that hackers use nowadays to gain access to protected systems. This is because cybersecurity has evolved and low-cost systems with the least security investments will need quite advanced and sophisticated mechanisms to be able to penetrate technically. Systems currently are equipped with at least some level of security, imposed by security firms with a very high level of expertise in managing the common and well-known attacks. This decreases the possible technical attack surface. Nation-states or advanced persistent threats (APTs), organized crime, and black hats possess the finance and skills to penetrate many different systems. However, they are always in need of the most available computing resources, such as central processing unit (CPU) and random-access memory (RAM), so they normally hack and hook computers into a botnet. This may allow them to perform dangerous distributed denial of service (DDoS) attacks and perform brute force cracking algorithms, which are highly CPU intensive. They may also use the zombie or drone systems they have hacked to hide their location on the net and gain anonymity by bouncing off around them many times a minute. Phishing allows them to gain their stretch of compromised systems to increase their power. For a normal hacker without the money to invest in sophisticated techniques, exploiting the human factor, which is the weakest link to security, comes in handy. The possibility of successfully manipulating the human into releasing the security that they set up makes the life of the hacker very easy, because they do not have to try to break into the system with force, rather the owner will just open the door for them. The objective of the research is to review factors that enhance phishing and improve the probability of its success. We have discovered that hackers rely on triggering the emotional effects of their victims through their phishing attacks. We have applied the use of artificial intelligence to be able to detect the emotion associated with a phrase or sentence. Our model had a good accuracy which could be improved with the use of a larger dataset with more emotional sentiments for various phrases and sentences. Our technique may be used to check for emotional manipulation in suspicious emails to improve the confidence interval of suspected phishing emails.

Highlights

Phishing is a form of social engineering, and an unethical act performed by malicious adversaries that aim to capture sensitive user information through manipulating human emotion
We have performed a high-level analysis of the techniques hackers use to penetrate systems with the use of email phishing
We have reviewed various literature from different authors about the ways to prevent phishing using machine learning and neural networks along with various approaches to determine what influences the success rate of phishing

Summary

Introduction

Phishing is a form of social engineering, and an unethical act performed by malicious adversaries that aim to capture sensitive user information through manipulating human emotion. They normally send fake links to them in the hope that they may be intimidated to see where they may take them These links direct the victims to evil websites, which leverage on the users‟ anticipation, sympathy, fear, or any other human-like factor to steal their confidential information, which they may later use to gain unauthorized entry into their systems. Once inside their systems, the hackers may gather the information that is even more critical. Because new techniques are always being devised by hackers, social engineering awareness training by far serves as the best means to prevent phishing attacks. (Saxena et al, 2019)

Objectives

Methods

Results

Conclusion