Anti-phishing Tools Research Articles

Unveiling suspicious phishing attacks: enhancing detection with an optimal feature vectorization algorithm and supervised machine learning

IntroductionThe dynamic and sophisticated nature of phishing attacks, coupled with the relatively weak anti-phishing tools, has made phishing detection a pressing challenge. In light of this, new gaps have emerged in phishing detection, including the challenges and pitfalls of existing phishing detection techniques. To bridge these gaps, this study aims to develop a more robust, effective, sophisticated, and reliable solution for phishing detection through the optimal feature vectorization algorithm (OFVA) and supervised machine learning (SML) classifiers.MethodsInitially, the OFVA was utilized to extract the 41 optimal intra-URL features from a novel large dataset comprising 2,74,446 raw URLs (134,500 phishing and 139,946 legitimate URLs). Subsequently, data cleansing, curation, and dimensionality reduction were performed to remove outliers, handle missing values, and exclude less predictive features. To identify the optimal model, the study evaluated and compared 15 SML algorithms arising from different machine learning (ML) families, including Bayesian, nearest-neighbors, decision trees, neural networks, quadratic discriminant analysis, logistic regression, bagging, boosting, random forests, and ensembles. The evaluation was performed based on various metrics such as confusion matrix, accuracy, precision, recall, F-1 score, ROC curve, and precision-recall curve analysis. Furthermore, hyperparameter tuning (using Grid-search) and k-fold cross-validation were performed to optimize the detection accuracy.Results and discussionThe findings indicate that random forests (RF) outperformed the other classifiers, achieving a greater accuracy rate of 97.52%, followed by 97.50% precision, and an AUC value of 97%. Finally, a more robust and lightweight anti-phishing model was introduced, which can serve as an effective tool for security experts, practitioners, and policymakers to combat phishing attacks.

Exploring Phishing Awareness and User Behavior: A Survey-based Investigation

Abstract: Phishing attacks remain a significant threat to internet users, exploiting vulnerabilities in human behaviour to deceive individuals into divulging sensitive information. Understanding user awareness of these attacks and their responses is crucial for developing an effective environment. This paper presents findings from a survey-based study aimed at assessing public awareness of phishing attacks and evaluating user responses. The survey explored participants' familiarity with phishing, knowledge levels, encounter frequencies, security practices, and responses to suspicious emails. Additionally, participants were queried about their experiences with phishing awareness training and their interest in receiving further education on the topic. The results provide insights into the current landscape of phishing awareness among internet users, highlighting areas of strength and vulnerability. These findings contribute to the ongoing efforts to enhance internet security and mitigate the risks posed by phishing attacks. The implications of the study's findings for cybersecurity education, awareness campaigns, and the development of anti-phishing tools are discussed.

Machine Learning Approaches For Phishing Detection: A Comparative Analysis

In this study, the effectiveness of four machine learning models in detecting phishing websites is evaluated. Utilizing a diverse dataset, the analysis reveals that Random Forest emerges as the top performer, achieving a test accuracy of 91.49%. Notably, Random Forest exhibits robustness in distinguishing between legitimate websites and malicious ones. While Decision Tree, K-Nearest Neighbors, and Naive Bayes also demonstrate promise, they encounter difficulties in accurately classifying phishing URLs, especially within certain categories. The findings underscore the pivotal role of machine learning in cybersecurity defence against phishing attacks. The study suggests avenues for future research, such as enhanced feature engineering and exploration of advanced ensemble techniques and deep learning approaches for improved phishing detection. This research contributes to the ongoing endeavours to develop more resilient anti-phishing tools and bolster digital security against evolving cyber threats. Key Words: Phishing, Machine Learning, Cybersecurity, Random Forest, Decision Tree, K-Nearest Neighbors, Naive Bayes, Website Detection, Feature Engineering, Ensemble Techniques, Model Comparison, Fine-Tuning.

Impact Of Web (URL) Phishing and Its Detection

Abstract: Web phishing is a persuasive and evolving cyber threat that poses significant risks to individuals, businesses, and organizations in the modern digital age. This paper aims to provide an overview of web phishing, focusing on its methods, detection techniques, and prevention. Phishing attacks occur when malicious actors use deceptive practices to trick people into divulging sensitive or classified information such as passwords, credit card details, or personal data. These attacks primarily manifest through emails, websites, or social engineering tactics. Phishing emails often impersonate trusted entities and lure recipients into clicking on malicious links or downloading harmful attachments. Web phishing involves using fraudulent websites that mimic legitimate ones to steal user information or deliver malware. Detecting web phishing attacks is an ongoing challenge due to the sophistication of attackers. Several detection techniques have been developed, including heuristic analysis, machine learning algorithms, and real-time URL analysis. These methods analyze various attributes of websites and emails to identify suspicious patterns or behaviors. Detecting web phishing is equally essential. Effective prevention strategies include user education and awareness programs, using two-factor authentication, regular software updates, and deploying advanced email filtering and anti-phishing tools. User training is crucial in helping individuals recognize phishing attempts and avoid falling victim to them.

CLASSIFICATION AND METHODS OF DETECTION OF PHISHING ATTACKS

The reliable operation of data transmission networks, computer systems and mobile devices is a mandatory condition for the effective functioning of the state and society, and the life of an individual. The reliability of key information systems for public use depends on many factors: cyber attacks, hardware and software failures, and various types of errors. Rapid expansion of threats to national security in the 21st century. entrusts state authorities with the tasks of their prevention, detection and neutralization. Cyber security is increasingly viewed as a fundamental problem of the state, which comprehensively affects its security, defense, economy, and almost all spheres of public life. The Internet gave a powerful impetus to the development of mass communication, trade and information exchange. However, today it is the area where many crimes are committed. The impersonal nature of digital infrastructure has made identity theft a natural and highly attractive project. Cybercriminals actively use various means of stealing information, including phishing. At the current stage and in the future, the development of both individual societies and states, as well as the world in general, will be carried out in accordance with the concept of the information society, which is connected with the use of information and telecommunication technologies in the acquisition, storage and processing of information in everyday life Phishing is a serious online security problem that involves spoofing genuine websites to trick online users and steal their confidential information. Analyzing these definitions, we can conclude that “phishing” can be considered in different ways, but the main purpose of its conduct remains unchanged—stealing data. The practical value of the results lies in the possibility of using the obtained classifier for further creation of software solutions for recognizing phishing sites. It, as well as a set of characteristics, can be implemented in anti-phishing browser extensions or other anti-phishing tools.

A Multi-vocal Literature Review on challenges and critical success factors of phishing education, training and awareness

Background:Phishing is a malicious attempt by cyber attackers to steal personal information through deception. Phishing attacks are often aided by carefully crafted phishing emails, which can go undetected by automated anti-phishing tools due to their limited accuracy. Studies found that user education, training, and awareness can thwart phishing attacks. Understanding diverse interconnected challenges and critical success factors of phishing education, training, and awareness (PETA) approaches can help improve organizations’ defense against phishing. Objective:This study presents a comprehensive, structured view of the challenges and critical success factors of the design, implementation, and evaluation stages of PETA. Method:We have conducted a Multi-vocal Literature Review (MLR) by systematically collecting 53 academic studies and 16 grey studies from popular databases by following a well-known MLR guideline. Results:We identified 20 challenges and 23 critical success factors, some of which involve human-centric and socio-technical factors in PETA. Our findings point out the need for designing explainable anti-phishing systems and developing automated tools and platforms to conduct real-world phishing studies. Conclusion:Our systematic analysis of 69 studies has enabled us to highlight the need for addressing human-centric issues, incorporating users’ knowledge gaps, and adopting personalized approaches in PETA.

Deep Learning Approach in Anti-Phishing Technology

A significant rise in electronic trade, or consumer-to-consumer online transactions, has occurred recently as a result of advances in Internet and cloud technologies. Malware, phishing, ransomware, man- in-the-middle attacks and other techniques are just a few of the ways cybercriminals utilize to begin a cyber attack. Phishing is a form of social engineering or a cyber security assault in which nefarious actors send messages acting as reliable individuals. Phishing attacks use complex strategies, techniques, and technologies to obtain sensitive data, including content injection, online social networks etc. Real-time identification of phishing sites is challenging with the available anti-phishing tools. Therefore, a protected and open system is required that allows the user to directly verify the site. The long short- term memory (LSTM) algorithm and the convolutional neural network (CNN) were combined to develop a hybrid deep learning model (LCR). The goal of this research was to develop a web browser named Phishing Detection Browser (PD Browser) that can identify phishing attacks using deep learning. Keywords— Phishing, Anti-Phishing, Deep learning, Hybrid Deep Learning Model

Anti-Phishing Tools: A Thorough Comparison of Features and Performance

Abstract: Phishing attacks are a common form of cyber-attacks that can result in data breaches, financial losses, and harm an organization's reputation. The purpose of the study is to evaluate and compare three popular anti-phishing tools' effectiveness in detecting and preventing such attacks. The research method involves conducting a study to identify best performing antiphishing tool. The findings show that some tools have high accuracy; others have a lower false positive rate. Overall, this research paper provides useful information about the effectiveness of anti-phishing tools and can help organizations select the most appropriate tool for their specific needs.

Detection Prevention and Proactive Prevention of Phishing Website

Phishing is frequently a routine attack on people when fake websites are used to trick individuals into divulging all of their personal information. Phishing records process tool URLs are used to steal personal data, including user names, passwords, and online banking activity. Attackers that utilize phishing techniques use websites with rectangular diplomas as a visual and semantic spoof of the real websites. Phishing strategies have advanced swiftly as the age has progressed; however, this may be avoided by using anti-phishing tools to spot phishing. A potent tool frequently utilized in the direction of phishing assaults is the machine planning to apprehend. The suggested system has also investigated the capabilities and methods of machine learning for detection.

Employing cluster-based class decomposition approach to detect phishing websites using machine learning classifiers

Phishing is an attack by cybercriminals to obtain sensitive information such as account IDs, usernames, and passwords through the use of the anonymous structure of the Internet. Although software companies are launching new anti-phishing tools that use blacklists, heuristics, visual methods, and machine learning-based methods, these products cannot prevent all phishing attacks. This research offers an opportunity to increase accuracy in the detection of phishing sites. This study develops a model using machine learning algorithms, specifically the decision tree and the random forest, due to their outperforming the rest of the classifiers and being accredited by researchers in this field to achieve the highest accuracy. The study is based on two phases: the first phase is to measure the accuracy of classifiers on the dataset in the usual way before and after feature selection. The second phase uses the class decomposition approach and measures the accuracy of classifiers in the dataset before feature selection and after feature selection to detect phishing sites. The class decomposition approach is a technique to improve the performance of classifiers by distributing each class into clusters and renaming the examples of each cluster with a new class. This provides a specific metric that more accurately predicts the level of phishing. Testing on a dataset containing 11,055 instances, 4,898 phishing, and 6,157 legitimate, each instance has 30 features. It achieved the highest accuracy in the first phase through the random forest algorithm by 96.9% before feature selection, and after feature selection, it was by 97.1%. In the second phase, the highest accuracy of both the decision tree and random forest classifiers was achieved by 100% with the two and four classes after feature selection. While before feature selection, the random forest algorithm achieved 100% with only the two classes.

Anti-Phishing Tools: State of the Art and Detection Efficiencies

Anti-Phishing Tools: State of the Art and Detection Efficiencies

PhisherCop: Developing an NLP-Based Automated Tool for Phishing Detection

Phishing poses a major security risk to organizations and individuals leading to loss of billions of dollars yearly. While risk communication serves as a tool to mitigate phishing attempts, it is imperative to create automated phishing detection tools. Numerous Natural Language Processing (NLP) approaches have been deployed to tackle phishing. However, phishing attempts continue to increase exponentially, which reiterates the need for more effective approach. To address this, we have developed an anti-phishing tool called; PhisherCop. PhisherCop is built upon Stochastic Gradient Descent classifier (SGD) and Support Vector Classifier (SVC) which showed an average accuracy of 96%, performing better than six other popular classifiers including: Decision Tree, Logistics Regression, Random Forest, Gradient Boosting Classifier, K-Nearest Neighbors and Multinomial Naive Bayes. Our tool is significant in distinguishing between phishing and legitimate content both over emails and text messages.

It's not just about accuracy: An investigation of the human factors in users' reliance on anti-phishing tools

Phishing attacks pose substantial threats to the security of individuals and organizations. Although current anti-phishing tools achieve high accuracy rates and present a potential solution to this problem, users are often reluctant to rely on the predictions of these competent tools. However, we continue to lack a means of resolving this reluctance—or even an explanation for it. To address this need and advance toward a solution, we investigate the factors that influence users' reliance on anti-phishing tools. Over the course of two studies, we test the effects of tool attributes (i.e., accuracy and frequency of phishing email predictions) and develop a model based on the notions of trust and distrust. Countering the common conjecture that tools are not accurate enough, we find that users' under-reliance is not an artifact of the insufficient accuracy of tools, as even in a 100% accuracy condition, users were under-reliant on tools. Rather, we find that while accuracy increases users' trust in tools, full reliance is inhibited by users' distrust, which is driven by a lack of transparency regarding tools' functionalities and the quantity of predictions provided. Thus, overall, our study shows the limits of accuracy in engendering reliance and explains the under-reliance phenomenon by showing that due to lack of knowledge or understanding, some users prefer to rely on their own inferior judgment instead of trusting and relying on the predictions provided by highly accurate tools.

Andrushchak I.Ye. Features of the main directions, techniques and methods of protection against fishing at-tacks.

This article discusses common modern heuristic technologies used in anti-phishing tools and protection methods. An overview of different types of mobile phishing attacks is given, as well as the main methods of detecting and reducing the level of fishing attacks.

Prediction of Phishing Susceptibility Based on a Combination of Static and Dynamic Features

Phishing is a very serious security problem that poses a huge threat to the average user. Research on phishing prevention is attracting increasing attention. The root cause of the threat of phishing is that phishing can still succeed even when anti-phishing tools are utilized, which is due to the inability of users to correctly identify phishing attacks. Current research on phishing focuses on examining the static characteristics of the phishing behavior phenomenon, which cannot truly predict a user’s susceptibility to phishing. In this paper, a user phishing susceptibility prediction model (DSM) that is based on a combination of dynamic and static features is proposed. The model investigates how the user’s static feature factors (experience, demographics, and knowledge) and dynamic feature factors (design changes and eye tracking) affect susceptibility. A hybrid Long Short-Term Memory (LSTM) and LightGBM prediction model is designed to predict user susceptibility. Finally, we evaluate the prediction performance of the DSM by conducting a questionnaire survey of 1150 volunteers and an eye-tracking experiment on 50 volunteers. According to the experimental results, the correct prediction rate of the DSM is higher than that for individual feature prediction, which reached 92.34%. These research experiments demonstrate the effectiveness of the DSM in predicting users’ susceptibility to phishing using a combination of static and dynamic features.

Combining Long-Term Recurrent Convolutional and Graph Convolutional Networks to Detect Phishing Sites Using URL and HTML

Phishing, a well-known cyber-attack practice has gained significant research attention in the cyber-security domain for the last two decades due to its dynamic attacking strategies. Although different solutions have been exercised against phishing, phishing attacks have dramatically increased in the past few years. Recent studies have shown that machine learning has become prominent in the present anti-phishing context, and the techniques like deep learning have extensively improved anti-phishing tools’ detection ability. This paper proposes PhishDet, a new way of detecting phishing websites through Long-term Recurrent Convolutional Network and Graph Convolutional Network using URL and HTML features. PhishDet is the first of its kind, which uses the powerful analysis and processing capabilities of Graph Neural Network in the anti-phishing domain and recorded 96.42% detection accuracy, with a 0.036 false-negative rate. It is effective against zero-day attacks, and the average detection time which is 1.8 seconds could also be considered realistic. The feature selection of PhishDet is automatic and occurs inside the system, as PhishDet gradually learns URLs and HTML content features to handle constantly changing phishing attacks. This has outperformed similar solutions by achieving a 99.53% f1-score with a public benchmark dataset. However, PhishDet requires periodic retraining to maintain its performance over time. If such retraining could be facilitated, PhishDet could fight against phishers for a more extended period to safeguard Internet users from this Internet threat.

Detection of Phishing Websites Using Deep Learning Techniques

Phishing is a deceitful trick of cyber-attack designed and implemented by scammers and hackers with purpose of stealing personal data by impersonating the original websites. Phishing is like fishing in a lake wherein the users are very conveniently be fooled by scammers (phishers) by impersonating original websites and contents to leak their valuable personal and professional data. Currently a lot of anti phishing tools and techniques are being applied to detect and nullify the phishing cyber threat viz, heuristic feature, blacklist or white list and visual similarity-based approaches. In this research paper, we have anticipated robust and novel anti-phishing models via (I) Long Short-Term Memory (LSTM), (II) Deep-Neural Network (DNN) and (III) Convolution-Neural Network (CNN) using 10 features. The anticipated model achieves an accuracy of 98.67% for LSTM, 96.33% for DNN and 97.23% for CNN. The proposed techniques are highly efficient and robust which increases the phishing detection manifold.

The Phishing Funnel Model: A Design Artifact to Predict User Susceptibility to Phishing Websites

Phishing is a significant security concern for organizations, threatening employees and members of the public. Phishing threats against employees can lead to severe security incidents, whereas those against the public can undermine trust, satisfaction, and brand equity. At the root of the problem is the inability of Internet users to identify phishing attacks even when using anti-phishing tools. We propose the phishing funnel model (PFM), a framework for predicting user susceptibility to phishing websites. PFM incorporates user, threat, and tool-related factors to predict actions during four key stages of the phishing process: visit, browse, consider legitimate, and intention to transact. We evaluated the efficacy of PFM in a 12-month longitudinal field experiment in two organizations involving 1,278 employees and 49,373 phishing interactions. PFM significantly outperformed competing models in terms of its ability to predict user susceptibility to phishing attacks. A follow-up three-month field study revealed that employees using PFM were significantly less likely to interact with phishing threats relative to comparison models and baseline warnings. Results of a cost-benefit analysis suggest that interventions guided by PFM could reduce annual phishing-related costs by nearly $1,900 per employee relative to comparison prediction methods.

LINKCALCULATOR – AN EFFICIENT LINK-BASED PHISHING DETECTION TOOL

The problem of phishing attacks continues to demand new solutions as existing solutions are limited by various challenges such as high computational requirements, zero-day attacks, needs for updates, complex ruled-based, etc. Besides, the emerging mobile market demands simple solutions to phishing due to several factors such as memory, fragmentation, etc. In response to the above challenges, a simple anti-phishing tool called LinkCalculator is presented. The proposed LinkCalculator anti-phishing scheme is based on an algorithm designed to extract link characteristics from loading URLs to determine their legitimacy. Unlike the other link-based extraction approaches, the proposed approach introduced the concept of weight to represent the different links found in a URL. This is because certain link information within parsed webpages or requests is sufficient to classify them as phishing without loss of generality. The approach is experimented using a dataset of 300 instances consisting of 150 legitimate URLs and 150 phishing URLs from openly-available research datasets. The experimental results indicate a significance performance of 100%. True Negative Rate and 0.00% False Positive Rate for legitimate instances and True Positive Rate of 96.67% with 0.03 % False Negative Rate for phishing instances which indicate that the approach offers a more efficient lightweight approach to phishing detection.

Phishing website detection based on effective machine learning approach

ABSTRACT Phishing a form of cyber-attack, which has an adverse effect on people where the user is directed to fake websites and duped to reveal their sensitive and personal information which includes passwords of accounts, bank details, atm pin-card details etc. Hence protecting sensitive information from malwares or web phishing is difficult. Machine learning is a study of data analysis and scientific study of algorithms, which has shown results in recent times in opposing phishing pages when distinguished with visualization, legal solutions, including awareness workshops and classic anti-phishing approaches. This paper examines the applicability of ML techniques in identifying phishing attacks and report their positives and negatives. In specific, there are many ML algorithms that have been explored to declare the appropriate choice that serve as anti-phishing tools. We have designed a Phishing Classification system which extracts features that are meant to defeat common phishing detection approaches. We also make use of numeric representation along with the comparative study of classical machine learning techniques like Random Forest, K nearest neighbours, Decision Tree, Linear SVC classifier, One class SVM classifier and wrapper-based features selection which contains the metadata of URLs and use the information to determine if a website is legitimate or not.