Anti-phishing Tools Research Articles

Detection of phishing attacks using the anti-phishing framework

. In the area of computer security, phishing is a form of criminal activity that involves obtaining sensitive data, such as access data for banking applications, e-commerce applications (such as eBay or PayPal) or credit card information, using techniques to manipulate the identity data of a person or institution. A phishing attack consists of sending the attacker an electronic message, using instant messaging software or telephone, in which the user is advised to give his confidential data to win certain prizes, or is informed that they are prizes. necessary due to technical errors that led to the loss of the original data. According to the reports of the AntiPhishing Working Group (APWG) published in December 2018, phishing against banking and the payment processor was high. Almost all phishy URLs use HTTPS and use redirects to avoid detection. This paper is a comparative survey of the available methods for detecting phishing sites. There has been a comparative study of anti-phishing tools and their limitations have been found. An anti-phishing model, a framework to help detect these attacks, is discussed. The identification of this type of attack is a very important problem considering that, at present, people carry out many online transactions regarding money transfer, payment of bills or purchases.

PhishStack: Evaluation of Stacked Generalization in Phishing URLs Detection

Stacked Generalization has been assessed and evaluated in the field of Phishing URLs detection. This field has become egregious area of information security. Recently, different phishing URLs detection systems have already proposed by several researchers. But due to the lack of proper machine learning algorithm selection, the performance of those systems can be affected. A details investigation on individual machine learning classifiers on level 1 and final prediction from level 2 along with three real datasets have been presented on this paper. The performance has been evaluated by precision-recall curve, AUC-ROC curve, accuracy, misclassification rate and mean absolute error (MAE). The best AUC area obtained from Random Forest and Multi Layer Perceptron (MLP) individually. But stacked generalization provides higher accuracy of 97.44% with numeric feature set in binary classification and in multiclass feature set (dataset three), provides the performance with 97.86% of accuracy. Stacked generalization provides minimum error rate and MAE of 2.142857% with multiclass feature set which leads to a strong basement of developing an anti-phishing tools.

Phishing Diagnosis: A Multi-Feature Decision Tree-based Method

Phishing is an electronically connected criminal activity in which the attacker steals the user’s personal information like username, countersign, internet banking account, credit/debit card number with the expiration date, password, pin, legitimacy, confidential patient record, CVV number, etc. to boon financially. Email-based phishing is the most common and traditional way of phishing scams, in which the phisher will send a suspicious email with an embedded URL and ask the user to click the URL. When the user clicks on the link, the link will be redirected to a spoofed site that looks the same to the original site to steal their credentials and displays some error message. Later the phishing uses those credentials for malicious purposes. To overcome these scams, many anti-phishing tools have developed. Among that the machine learning-based approaches can give a better result. This paper is an extensive study of the various machine learning-based anti-phishing approaches and their results that detect the phishing URL's from the URLs with URLs features. Six most important models of machine learning have been examined for the phishing detection problem. The Decision Tree-based method outperforms other methods.

Classification of Anti-phishing Solutions

Phishing is an online fraud through which phisher gains unauthorized access to the user system to lure the personal credentials (such as username, password, credit/debit card number, validity, CVV number, and pin) for financial gain. Phishing can be carried out in many ways: through emails, phone calls, instant messages, advertisements, and popups on the website and poisoning the DNS. To protect the users from phishing, many anti-phishing toolbars/extensions had been developed. These anti-phishing tools prevent the Internet users not to fall a victim of phishing scams. No anti-phishing approach can give 100 % security. In this paper, we present a complete classification of an anti-phishing solution in algorithmic perspective. The taxonomy helps in understanding various anti-phishing approaches and algorithms developed for phishing detection. Popular anti-phishing toolbars are taken to show the media they address, mode of operation, and their pros and cons. It also provides further research gap that has to be addressed.

Conveying Automation Reliability and Automation Error Type An Empirical Study in the Cyber Domain

Background Emails have become an integral part of our daily life and work. Phishing emails are often disguised as trustworthy ones and attempt to obtain sensitive information for malicious reasons (Egelman, Cranor, Hong, 2008;). Anti-phishing tools have been designed to help users detect phishing emails or websites (Egelman, et al., 2008; Yang, Xiong, Chen, Proctor, & Li, 2017). However, like any other types of automation aids, these tools are not perfect. An anti-phishing system can make errors, such as labeling a legitimate email as phishing (i.e., a false alarm) or assuming a phishing email as legitimate (i.e., a miss). Human trust in automation has been widely studied as it affects how the human operator interacts with the automation system, which consequently influences the overall system performance (Dzindolet, Peterson, Pomranky, Pierce, & Beck, 2003; Lee & Moray, 1992; Muir, 1994; Sheridan & Parasuraman, 2006). With interacting with an automation system, the human operator should calibrate his or her trust level to trust a system that is capable but distrust a system that is incapable (i.e., trust calibration; Lee & Moray, 1994; Lee & See, 2004; McGuirl & Sarter, 2006). Among the various system capabilities, automation reliability is one of the most important factors that affect trust, and it is widely accepted that higher reliability levels lead to higher trust levels (Desai et al., 2013; Hoff & Bashir, 2015). How well these capabilities are conveyed to the operator is essential (Lee & See, 2004). There are two general ways of conveying the system capabilities: through an explicit description of the capabilities (i.e., description), or through experiencing the system (i.e., experience). These two ways of conveying information have been studied widely in human decision-making literature (Wulff, Mergenthaler-Canseco, & Hertwig, 2018). Yet, there has not been systematic investigation on these different methods of conveying information in the applied area of human-automation interaction (but see Chen, Mishler, Hu, Li, & Proctor, in press; Mishler et al., 2017). Furthermore, trust and reliance on automation is not only affected by the reliability of the automation, but also by the error types, false alarms and misses (Chancey, Bliss, Yamani, & Handley, 2017; Dixon & Wickens, 2006). False alarms and misses affect human performance in qualitatively different ways, with more serious damage being caused by false-alarmprone automation than by miss-prone automation (Dixon, Wickens, & Chang, 2004). In addition, false-alarm-prone automation reduces compliance (i.e., the operator’s reaction when the automation presents a warning); and miss-prone automation reduces reliance (i.e., the operator’s inaction when the automation remains silent; Chancey et al., 2017). Current Study The goal of the current study was to examine how the methods of conveying system reliability and automation error type affect human decision making and trust in automation. The automation system was a phishing-detection system, which provided recommendations to users as to whether an email was legitimate or phishing. The automation reliability was defined as the percentage of correct recommendations (60% vs. 90%). For each reliability level, there were a false-alarm condition, with all the automation errors being false alarms, and a miss condition, with all the errors being misses. The system reliability was conveyed through description (with an exact percentage described to the user) or experience (with immediate feedback to help the user learn; Barron, & Erev, 2003). A total of 510 participants were recruited and completed the experiment online through Amazon Mechanical Turk. The experimental task consisted of classifying 20 emails as phishing and legitimate, with a phishing-detection system providing recommendations. At the end of the experiment, participants rated their trust in this automated aid system. The measures included a performance measure (the decision accuracy made by the participants), as well as two trust measures (participants’ agreement rate with the phishing-detection system, and their self-reported trust in the system). Our results showed that higher system reliability and feedback increased accuracy significantly, but description or error type alone did not affect accuracy. In terms of the trust measures, false alarms led to lower agreement rates than did misses. With a less reliable system, though, the misses caused a problem of inappropriately higher agreement rates; this problem was reduced when feedback was provided for the unreliable system, indicating a trust-calibration role of feedback. Self-reported trust showed similar result patterns to agreement rates. Performance was improved with higher system reliability, feedback, and explicit description. Design implications of the results included that (1) both feedback and description of the system reliability should be presented in the interface of an automation aid whenever possible, provided that the aid is reliable, and (2) for systems that are unreliable, false alarms are more desirable than misses, if one has to choose between the two.

Phishing attempts among the dark triad: Patterns of attack and vulnerability

Phishing attacks are more common and more sophisticated than other forms of social engineering attacks. This study presents an investigation of the relationships between three personality traits—Machiavellianism, narcissism, and psychopathy (i.e., the Dark Triad)—and phishing effort, attack success, and end-user susceptibility to phishing emails. Participants were recruited in two stages. The first set of participants acted as attackers, creating phishing emails. The second set of participants acted as end-users, reading both benevolent and phishing emails and indicating their likely behavioral response to each email. Our findings suggest that attackers' Dark Triad scores relate to the effort that they put in writing a phishing email, but do not predict phishing success. Instead, it is the end-users’ Dark Triad scores that predict the success of phishing emails. We found that higher levels of attacker Machiavellianism were linked to increased phishing effort, while end-user narcissism was associated to greater vulnerability when receiving phishing emails. Furthermore, our findings suggest that narcissistic end-users were marginally more susceptible to phishing emails that originated from narcissistic attackers. These results have important practical implications for training, anti-phishing tool development, and policy in organizations.

Phishing Detection: A Case Analysis on Classifiers with Rules Using Machine Learning

A typical predictive approach in data mining that produces If-Then knowledge for decision making is rule-based classification. Rule-based classification includes a large number of algorithms that fall under the categories of covering, greedy, rule induction, and associative classification. These approaches have shown promising results due to the simplicity of the models generated and the user’s ability to understand, and maintain them. Phishing is one of the emergent online threats in web security domains that necessitates anti-phishing models with rules so users can easily differentiate among website types. This paper critically analyses recent research studies on the use of predictive models with rules for phishing detection, and evaluates the applicability of these approaches on phishing. To accomplish our task, we experimentally evaluate four different rule-based classifiers that belong to greedy, associative classification and rule induction approaches on real phishing datasets and with respect to different evaluation measures. Moreover, we assess the classifiers derived and contrast them with known classic classification algorithms including Bayes Net and Simple Logistics. The aim of the comparison is to determine the pros and cons of predictive models with rules and reveal their actual performance when it comes to detecting phishing activities. The results clearly showed that eDRI, a recently greedy algorithm, not only generates useful models but these are also highly competitive with respect to predictive accuracy as well as runtime when they are employed as anti-phishing tools.

Identification of phishing webpages and its target domains by analyzing the feign relationship

Phishing is the act of stealing personal information from the online users by impersonating as a statutory source in the cyberspace. Phishers often bait online users to visit their forged webpages to acquire users sensitive information. Most of the anti-phishing techniques today, endeavor to identify the legitimacy of the webpages the user visits and warn them with a phishing label when the webpage is a phish. But, these warnings generated by the anti-phishing tools are generic and does not provide any assistance for the users to safely navigate to the legitimate webpages. Any anti-phishing technique will be incomplete and incompetent without having a victimized domain identification in place. The method proposed in this paper addresses this lacuna by automatically identifying the victimized domain (target domain) of every successfully distinguished phishing webpage. This method initially identifies the possible target domains of the webpage by analyzing the feign relationships which exist between the webpage and its associated domains through the in-degree link associations. Further, a novel Target Validation (TVD) algorithm is used to ensure the correctness of the identified target domain which in turn helps in reducing the false target predictions of the system. The legitimacy of the webpage is further confirmed using the identified target domain. The experiment results show that this method is efficient in protecting users from the online identity attacks and also in identifying victimized domain with over 99% accuracy.

A Comparative Analysis of Anti-Phishing Mechanisms: Email Phishing

Phishing has created a serious threat towards internet security. Phish e-mails are used chiefly to deceive confidential information of individual and organizations. Phishing e-mails entice naive users and organizations to reveal confidential information such as, personal details, passwords, account numbers, credit card pins, etc. Phisher spread spoofed e-mails as coming from legitimate sources, phishers gain access to such sensitive information that eventually results in identity and financial losses.In this research paper,aexhaustive study is done on anti-phishing mechanism from year 2002 to 2014. A comparative analysis report of anti-phishing detection, prevention and protection mechanisms from last decade is listed. This comparativeanalysis reports the anti-phishing mechanism run on server side or client side and which vulnerable area is coverd by it. The vulnerable area is divided into three categories on the basis of email structure. The number of vulnerabilties covered by existing anti-phishing mechanisms are listed to identify the focus or unfocused vulnerability. This research paper could be said as tutorial of a existing anti-phishing research work from decade. The current work examines the effectiveness of the tools and techniques against email phishing. It aims to determine pitfalls and vulnerability of anti-phishing tools and techniques against email phishing. This work could improve the understanding of the security loopholes, the current solution space, and increase the accuracy or performance to counterfeit the phishing attack. Keywords: Phishing, E-mail phishing, Information security, web vulnerabilities, cyber-security.

Experimental Analysis of Browser based Novel Anti-Phishing System Tool at Educational Level

In the phishing attack, the user sends their confidential information on mimic websites and face the financial problem, so the user should be informed immediately about the visiting website. According to the Third Quarter Phishing Activity Trends Report, there are 55,282 new phishing websites have been detected in the month of July 2014. To solve the phishing problem, a browser based add-on system may be one of the best solution to aware the user about the website type. In this paper, a novel browser based add-on system is proposed and compared its performance with the existing antiphishing tools. The proposed anti-phishing tool ‘ePhish’ is compared with the existing browser based antiphishing toolbars. All the anti-phishing tools have been installed in computer systems at an autonomous college to check their performance. The obtained result shows that if the task is divided into a group of systems, it can give better results. For different phishing features, the add-on system tool show around 97 percentage successful results at different case conditions. The current study would be very helpful to countermeasure the phishing attach and the proposed system is able to protect the user by phishing attacks. Since the system tool is capable of handling and managing the phishing website details, so it would be helpful to identify the category of the websites.

Performance Analysis of Anti-Phishing Tools and Study of Classification Data Mining Algorithms for a Novel Anti-Phishing System

The term Phishing is a kind of spoofing website which is used for stealing sensitive and important information of the web user such as online banking passwords, credit card information and user’s password etc. In the phishing attack, the attacker generates the warning message to the user about the security issues, ask for confidential information through phishing emails, ask to update the user’s account information etc. Several experimental design considerations have been proposed earlier to countermeasure the phishing attack. The earlier systems are not giving more than 90 percentage successful results. In some cases, the system tool gives only 50-60 percentage successful result. In this paper, a novel algorithm is developed to check the performance of the anti-phishing system and compared the received data set with the data set of existing anti-phishing tools. The performance evaluation of novel anti-phishing system is studied with four different classification data mining algorithms which are Class Imbalance Problem (CIP), Rule based Classifier (Sequential Covering Algorithm (SCA)), Nearest Neighbour Classification (NNC), Bayesian Classifier (BC) on the data set of phishing and legitimate websites. The proposed system shows less error rate and better performance as compared to other existing system tools.

Examining the effectiveness of phishing filters against DNS based phishing attacks

Purpose– This paper aims to report on research that tests the effectiveness of anti-phishing tools in detecting phishing attacks by conducting some real-time experiments using freshly hosted phishing sites. Almost all modern-day Web browsers and antivirus programs provide security indicators to mitigate the widespread problem of phishing on the Internet.Design/methodology/approach– The current work examines and evaluates the effectiveness of five popular Web browsers, two third-party phishing toolbar add-ons and seven popular antivirus programs in terms of their capability to detect locally hosted spoofed websites. The same tools have also been tested against fresh phishing sites hosted on Internet.Findings– The experiments yielded alarming results. Although the success rate against live phishing sites was encouraging, only 3 of the 14 tools tested could successfully detect a single spoofed website hosted locally.Originality/value– This work proposes the inclusion of domain name system server authentication and verification of name servers for a visiting website for all future anti-phishing toolbars. It also proposes that a Web browser should maintain a white list of websites that engage in online monetary transactions so that when a user requires to access any of these, the default protocol should always be HTTPS (Hypertext Transfer Protocol Secure), without which a Web browser should prevent the page from loading.

Complementing Blacklists: An Enhanced Technique to Learn Detection of Zero-Hour Phishing URLs

Increased phishing attacks despite existing antiphishing tools suggests that the tools are not catching up with the attacks technically. Majority of the tools depend on blacklists which are way short in tackling zero-hour attacks, while existing heuristic tools are also less performing. We propose a machine learning classifier to complement a blacklist approach. The classifier uses a wide range of predictive features compared to those in similar studies, categorized as URL characteristics, web page contents, domain features and domain reputation/ranking. Using six different machine learning algorithms and a dataset of 890 URLs, our classifier achieved the best performance compared to similar solutions, attaining an accuracy of 99.89%, false positive 0.0% and false negative 0.1%. Domain reputation features were the most predictive while web page content features were the least ones. Individually, blacklist reputation and Alexa ranking were the most influential features whereas popup login windows and hexadecimal number were the least ones.

Enhancing Predictive Analytics for Anti-Phishing by Exploiting Website Genre Information

Phishing websites continue to successfully exploit user vulnerabilities in household and enterprise settings. Existing anti-phishing tools lack the accuracy and generalizability needed to protect Internet users and organizations from the myriad of attacks encountered daily. Consequently, users often disregard these tools’ warnings. In this study, using a design science approach, we propose a novel method for detecting phishing websites. By adopting a genre theoretic perspective, the proposed genre tree kernel method utilizes fraud cues that are associated with differences in purpose between legitimate and phishing websites, manifested through genre composition and design structure, resulting in enhanced anti-phishing capabilities. To evaluate the genre tree kernel method, a series of experiments were conducted on a testbed encompassing thousands of legitimate and phishing websites. The results revealed that the proposed method provided significantly better detection capabilities than state-of-the-art anti-phishing methods. An additional experiment demonstrated the effectiveness of the genre tree kernel technique in user settings; users utilizing the method were able to better identify and avoid phishing websites, and were consequently less likely to transact with them. Given the extensive monetary and social ramifications associated with phishing, the results have important implications for future anti-phishing strategies. More broadly, the results underscore the importance of considering intention/purpose as a critical dimension for automated credibility assessment: focusing not only on the “what” but rather on operationalizing the “why” into salient detection cues.

Towards a contingency approach with whitelist- and blacklist-based anti-phishing applications: what do usability tests indicate?

In web browsers, a variety of anti-phishing tools and technologies are available to assist users to identify phishing attempts and potentially harmful pages. Such anti-phishing tools and technologies provide Internet users with essential information, such as warnings of spoofed pages. To determine how well users are able to recognise and identify phishing web pages with anti-phishing tools, we designed and conducted usability tests for two types of phishing-detection applications: blacklist-based and whitelist-based anti-phishing toolbars. The research results mainly indicate no significant performance differences between the application types. We also observed that, in many web browsing cases, a significant amount of useful and practical information for users is absent, such as information explaining professional web page security certificates. Such certificates are crucial in ensuring user privacy and protection. We also found other deficiencies in web identities in web pages and web browsers that present challenges to the design of anti-phishing toolbars. These challenges will require more professional, illustrative, instructional, and reliable information for users to facilitate user verification of the authenticity of web pages and their content.

An Empirical Analysis of the Effectiveness of Browser-based Antiphishing Solutions

Phishing has by far become the most dangerous form of fraud to hit online business. Due to the key role in accessing the Internet, web browsers are at a strategic position to offer the protection against the risks of phishing attacks. Varieties of security companies have proposed their browser-based antiphishing solutions to protect the end-use. In this paper, we used 3403 fresh phishing URLs and 1000 legitimate URLs to conduct four experiments on ten popular anti-phishing tools including browsers and browser plug-ins. Overall, we found that the Google Chrome and Firefox identified the most phishing sites, but these two browsers still missed more than 20% fraudulent sites. Qihoo 360 Secure Explorer did a strong performance under the APAC dataset that demonstrate their excellent abilities of the Chinese-target phishing detection. We also found that different anti-phishing tools have totally different reactions between regions and languages. And finally, we proposed our suggestions for designing a comprehensive anti-phishing mechanism.

An efficient phishing webpage detector

Phishing attack is growing significantly each year and is considered as one of the most dangerous threats in the Internet which may cause people to lose confidence in e-commerce. In this paper, we present a heuristic method to determine whether a webpage is a legitimate or a phishing page. This scheme could detect new phishing pages which black list based anti-phishing tools could not. We first convert a web page into 12 features which are well selected based on the existing normal and fishing pages. A training set of web pages including normal and fishing pages are then input for a support vector machine to do training. A testing set is finally fed into the trained model to do the testing. Compared to the existing methods, the experimental results show that the proposed phishing detector can achieve the high accuracy rate with relatively low false positive and low false negative rates.

BogusBiter

Many anti-phishing mechanisms currently focus on helping users verify whether a Web site is genuine. However, usability studies have demonstrated that prevention-based approaches alone fail to effectively suppress phishing attacks and protect Internet users from revealing their credentials to phishing sites. In this paper, instead of preventing human users from “biting the bait,” we propose a new approach to protect against phishing attacks with “bogus bites.” We developBogusBiter, a unique client-side anti-phishing tool, which transparently feeds a relatively large number of bogus credentials into a suspected phishing site. BogusBiter conceals a victim's real credential among bogus credentials, and moreover, it enables a legitimate Web site to identify stolen credentials in a timely manner. Leveraging the power of client-side automatic phishing detection techniques, BogusBiter is complementary to existing preventive anti-phishing approaches. We implemented BogusBiter as an extension to the Firefox 2 Web browser, and evaluated its efficacy through real experiments on both phishing and legitimate Web sites. Our experimental results indicate that it is promising to use BogusBiter to transparently protect against phishing attacks.

Itrustpage

Despite the many solutions proposed by industry and the research community to address phishing attacks, this problem continues to cause enormous damage. Because of our inability to deter phishing attacks, the research community needs to develop new approaches to anti-phishing solutions. Most of today's anti-phishing technologies focus on automatically detecting and preventing phishing attacks. While automation makes anti-phishing tools user-friendly, automation also makes them suffer from false positives, false negatives, and various practical hurdles. As a result, attackers often find simple ways to escape automatic detection. This paper presents iTrustPage - an anti-phishing tool that does not rely completely on automation to detect phishing. Instead, iTrustPage relies on user input and external repositories of information to prevent users from filling out phishing Web forms. With iTrustPage, users help to decide whether or not a Web page is legitimate. Because iTrustPage is user-assisted, iTrustPage avoids the false positives and the false negatives associated with automatic phishing detection. We implemented iTrustPage as a downloadable extension to FireFox. After being featured on the Mozilla website for FireFox extensions, iTrustPage was downloaded by more than 5,000 users in a two week period. We present an analysis of our tool's effectiveness and ease of use based on our examination of usage logs collected from the 2,050 users who used iTrustPage for more than two weeks. Based on these logs, we find that iTrustPage disrupts users on fewer than 2% of the pages they visit, and the number of disruptions decreases over time.