Email Attacks Research Articles

Combating Phishing in Kenya: A Supervised Learning Model for Enhanced Email Security in Kenyan Financial Institutions

Purpose: Phishing is a serious cybercrime problem that puts people and organizations at risk all around the world, especially in Republic of Kenya's financial institutions. Modern solutions are required because traditional security measures are being challenged by the growing sophistication of phishing attempts. The goal of this thesis is to use artificial intelligence (AI) to create a supervised machine learning model that will alleviate phishing email attacks in the Kenyan financial institutions. Attackers frequently use phishing emails as a means of obtaining unauthorized access to private information, including login credentials, financial information, and personal information. This can lead to identity theft, reputational harm, and monetary losses. Methodology: The suggested framework focuses on using supervised machine learning techniques to recognize and stop phishing emails with accuracy. Four primary parts make up the framework: response, email filtering, feature extraction, and categorization. Four primary steps are involved in developing the framework: gathering data, preparing the data, training the model, and deployment. A thorough dataset of phishing and non-phishing emails is compiled throughout the data collecting phase from a variety of sources, including as public databases, forums on the dark web, and emails from financial institutions staff. Cleaning, classifying, and preprocessing the gathered data are all part of the data preprocessing step, which makes sure the data is appropriate for training the model. Supervised machine learning methods are used in the model training phase to create a reliable detection model. Findings: The system is tested against a dataset of phishing and non-phishing emails particular to the Kenyan financial sectors. The framework's effectiveness is assessed using performance indicators such as accuracy, precision, recall, and the F1-score. The results reveal that the system can correctly detect new phishing emails that were not previously included in the training dataset, demonstrating its adaptability to emerging threats. Unique Contribution to Theory, Practice and Policy: By offering an effective mechanism for detecting and alleviating phishing email attacks, the proposed framework considerably minimizes the risk of data breaches and financial losses in the banking sector.

Framework for Mitigating Phishing E-mail in the Kenyan Banking Industry Using Artificial Intelligence (AI)

Purpose: Phishing is a significant cybercrime threat that affects individuals and organizations globally, including the banking industry in Kenya. The sophistication of phishing attacks continues to increase, and it is increasingly challenging traditional security measures to mitigate these threats. The purpose of this thesis is to build a framework for mitigating phishing e-mail attacks in the banking industry in Kenya using artificial intelligence. Phishing emails are among the most common techniques of cyber-attacks utilized by assailants to gain unauthorized access to sensitive information such as financial details, personal information, and login credentials. These attacks can have devastating effects on the victims, leading to financial loss, reputation damage, and even identity theft. Methodology: The framework development consists of four main stages: data collection, data preprocessing, model training, and deployment. In the data collection stage, a dataset of phishing and non-phishing emails is gathered from various sources such as public databases, dark web forums, and bank employees mail. In the data preprocessing stage, the collected data is cleaned, preprocessed, and labeled. In the model training stage, machine learning algorithms and NLP techniques is used to develop a robust phishing and non-phishing emails detection model. In the deployment stage, the model is integrated into the bank's email system to detect and block phishing emails in real-time. The framework is then evaluated using a dataset of phishing and non-phishing e-mails collected from the banking industry in Kenya. Various metrics such as accuracy, precision, recall, and F1-score are used to evaluate the framework. The framework is able to detect new phishing e-mails that were not previously included in the dataset, demonstrating its ability to adapt to new threats. Findings: The framework is based on a hybrid approach that combines machine learning algorithms, natural language processing (NLP) techniques, and human expertise that identify and prevent phishing emails from reaching their targets. The four main components of this framework include e-mail filtering, feature extraction, classification, and response. The e-mail filtering component uses several algorithms to identify and filter suspicious e-mails. The feature extraction component analyzes the content of the e-mail and extracts relevant features to help classify the e-mail as either legitimate or phishing. The classification component uses machine-learning algorithms to classify the e-mail as either legitimate or phishing. Finally, the response component takes appropriate action based on the classification results. Unique Contribution to Theory, Practice and Policy: The framework provides an effective way to identify and mitigate phishing e-mail attacks, reducing the risk of data breaches and financial losses.

Analysis and Prevention of AI-Based Phishing Email Attacks

Phishing email attacks are among the most common and most harmful cybersecurity attacks. With the emergence of generative AI, phishing attacks can be based on emails generated automatically, making it more difficult to detect them. That is, instead of a single email format sent to a large number of recipients, generative AI can be used to send each potential victim a different email, making it more difficult for cybersecurity systems to identify the scam email before it reaches the recipient. Here, we describe a corpus of AI-generated phishing emails. We also use different machine learning tools to test the ability of automatic text analysis to identify AI-generated phishing emails. The results are encouraging, and show that machine learning tools can identify an AI-generated phishing email with high accuracy compared to regular emails or human-generated scam emails. By applying descriptive analytics, the specific differences between AI-generated emails and manually crafted scam emails are profiled and show that AI-generated emails are different in their style from human-generated phishing email scams. Therefore, automatic identification tools can be used as a warning for the user. The paper also describes the corpus of AI-generated phishing emails that are made open to the public and can be used for consequent studies. While the ability of machine learning to detect AI-generated phishing emails is encouraging, AI-generated phishing emails are different from regular phishing emails, and therefore, it is important to train machine learning systems also with AI-generated emails in order to repel future phishing attacks that are powered by generative AI.

IMPLEMENTATION OF DYNAMIC METHOD FOR MALWARE DETECTION IN EMAIL PHISHING ATTACKS ON LET'S DEFEND

In the rapidly evolving landscape of cybersecurity threats, the need for robust defenses against phishing attacks has become paramount. This study explores the efficacy of malware detection in phishing email attacks using dynamic analysis on the Letsdefend.io platform. Leveraging the insights provided by the Deloitte Center for Controllership regarding the escalating frequency of cyber adversaries targeting organizational data, this research investigates the effectiveness of the Letsdefend.io platform, particularly utilizing the SOC 146 rule, in identifying and mitigating phishing threats. Through a comprehensive analysis process encompassing dynamic malware analysis techniques, such as those employed by VirusTotal and URLHaus, alongside detailed examination of suspicious email attachments using the Mailbox feature, this study aims to provide insights into the evolving tactics of phishing attackers, specifically those utilizing Excel 4.0 Macros. The research methodology involves collecting malware samples for analysis, configuring sandbox environments with tools like Process Monitor and Regshot, and utilizing sophisticated analysis tools like ProcDot to visualize malware behavior. Additionally, the study examines the effectiveness of the Letsdefend.io platform in detecting phishing URLs and malicious domains reported by AnyRun and URLHaus databases. The findings reveal promising results in the detection and identification of phishing threats, shedding light on the potential of dynamic analysis methods in bolstering cybersecurity defenses against evolving phishing techniques. This research contributes to the ongoing efforts to enhance cybersecurity measures and protect organizational assets from the pervasive threat of phishing attacks.

Detecting attacks on e-mail

E-mail has become a popular communication tool widely used by universities, enterprises and governments. Despite the convenience it brought to people, attacks on e-mail happen very frequently in the range of the world, causing large economic loss and occupying a mass of network bandwidth every year. The hazards from e-mail attacks underline the importance of detecting and resisting spam in an efficient and timely way. Using Python, we built Na¨ıve Bayes (NB) and support vector machine (SVM) filters for emails. The filtering performance of NB and SVM email filters applying different kernel functions was compared and evaluated based on several evaluation indices including accuracy, precision, and total cost ratio (TCR). Also, in order to optimize the filters, the influences of stop words removal, feature numbers and other parameters in the filtering algorithms were monitored.

Towards a Hybrid Security Framework for Phishing Awareness Education and Defense

The rise in generative Artificial Intelligence (AI) has led to the development of more sophisticated phishing email attacks, as well as an increase in research on using AI to aid the detection of these advanced attacks. Successful phishing email attacks severely impact businesses, as employees are usually the vulnerable targets. Defense against such attacks, therefore, requires realizing defense along both technological and human vectors. Security hardening research work along the technological vector is few and focuses mainly on the use of machine learning and natural language processing to distinguish between machine- and human-generated text. Common existing approaches to harden security along the human vector consist of third-party organized training programmes, the content of which needs to be updated over time. There is, to date, no reported approach that provides both phishing attack detection and progressive end-user training. In this paper, we present our contribution, which includes the design and development of an integrated approach that employs AI-assisted and generative AI platforms for phishing attack detection and continuous end-user education in a hybrid security framework. This framework supports scenario-customizable and evolving user education in dealing with increasingly advanced phishing email attacks. The technological design and functional details for both platforms are presented and discussed. Performance tests showed that the phishing attack detection sub-system using the Convolutional Neural Network (CNN) deep learning model architecture achieved the best overall results: above 94% accuracy, above 95% precision, and above 94% recall.

Designing an Email Attack by Analysing the Victim’s Profile. An Alternative Anti-Phishing Training Method

According to Thomson-Reuters the top cyber threat today is phishing in which people are tricked either to click a malicious link or give out personal information. It’s a fact that 96% of these phishing attacks comes from emails, which amount to more than 3.4 billion daily, as reported by Cisco. Austrian aerospace company FACC, Belgian bank Crelan, Acorn financial services and many other companies were recently fell victims of phishing emails losing millions of dollars. Even if experts provide lists of signs that users should seek in an email in order to understand if it is legitimate or scam, the attackers have elevated the quality of the email messages making them believable and very hard to discern them. In order to respond to this elevated threat, unconventional user training is required, focusing on recognizing a phishing email. Knowing how an attacker thinks and prepares the attack vector against a target, we claim that it will make users more suspicious when they receive one. In this regard, an innovative education intervention (consisted of two phases) was designed and developed. In the first phase, 98 participants were asked to visit an artificial social media profile and prepare a phishing email in order to persuade the victim to click a link. Then, the participants were presented with an innovative guided workflow to prepare a spear phishing email which was based on social media intelligence. In the second phase, they were asked to prepare one more email for the same person applying this time the guided workflow. Comparing the two different emails created, we found that the guided workflow led to the creation of more authentic emails which could potentially trick the victim easier. Based on the theory of active learning, we believe that by teaching users how attackers exploit their personal information in order to develop their attack vectors, it will increase their awareness not only for the typical phishing emails but also for more sophisticated spear phishing attacks.

Towards a thematic dimensional framework of online fraud: An exploration of fraudulent email attack tactics and intentions

Despite anti-phishing filters, social engineering-based cyber-attacks still result in billions of dollars lost annually, significant personal identity theft, loss of corporate secrets, and espionage. We review the phishing literature on psychological attacks and design tactics employed for deception by attackers. The result reveals the need to continuously identify tactics embedded in fraudulent email content to understand why users still fall prey to phishing attacks. Using the literature as a backdrop, we identify and conceptualize a thematic dimensional framework of fraudulent phishing attacks. This study uses benchmark datasets of fraudulent email to empirically validate the proposed dimensional framework. Specifically, a combination of machine learning-based content analysis and topic modeling found a majority of the discovered topics were labeled against the proposed dimensions. Statistical analysis was employed to provide empirical evidence of the thematic dimensions of fraudulent email attacks. This study thus, not only extends the cybersecurity literature by identifying and validating eight dimensions that enrich our understanding of phishing and attack identification but stimulates cumulative research endeavors to develop yet more comprehensive dimensional frameworks of phishing email attacks.

HELPHED: Hybrid Ensemble Learning PHishing Email Detection

Phishing email attack is a dominant cyber-criminal strategy for decades. Despite its longevity, it has evolved during the COVID-19 pandemic, indicating that adversaries exploit critical situations to lure victims. Plenty of detectors have been proposed over the years, which mainly focus on the contents or the textual information of emails; however, to cope with the evolution of phishing emails more sophisticated approaches should be introduced that will exploit all the emails’ traits to enhance the detection capability of Machine Learning/Deep Learning classifiers. To tackle the limitations of existing works, this paper proposes a phishing email detection methodology, named HELPHED that focuses on the detection of phishing emails by combining Ensemble Learning methods with hybrid features. The hybrid features provide an accurate representation of emails by fusing their content and textual traits. We propose two methods of HELPHED, the first one employs the Stacking Ensemble Learning method, while the second method utilizes the Soft Voting Ensemble Learning. Both methods deploy two different Machine Learning algorithms to handle the hybrid features separately, yet in parallel, minimizing the features’ complexity and improving the model’s performance. A thorough evaluation analysis is carried out considering innovative guidelines that aim to prevent partial and misleading results. Experimental tests verified that the combination of hybrid features with Ensemble Learning, overall, accomplishes better detection performance than when employing only content-based or text-based features. Numerical results on a rich imbalanced dataset (i.e., 32,051 benign and 3,460 phishing email samples) that considers the evolution of phishing emails show that Soft Voting Ensemble Learning outperforms other prominent Machine Learning/Deep Learning algorithms and existing works yielding F1-score equal to 0.9942.

Cloud-based email phishing attack using machine and deep learning algorithm

Cloud computing refers to the on-demand availability of personal computer system assets, specifically data storage and processing power, without the client's input. Emails are commonly used to send and receive data for individuals or groups. Financial data, credit reports, and other sensitive data are often sent via the Internet. Phishing is a fraudster's technique used to get sensitive data from users by seeming to come from trusted sources. The sender can persuade you to give secret data by misdirecting in a phished email. The main problem is email phishing attacks while sending and receiving the email. The attacker sends spam data using email and receives your data when you open and read the email. In recent years, it has been a big problem for everyone. This paper uses different legitimate and phishing data sizes, detects new emails, and uses different features and algorithms for classification. A modified dataset is created after measuring the existing approaches. We created a feature extracted comma-separated values (CSV) file and label file, applied the support vector machine (SVM), Naive Bayes (NB), and long short-term memory (LSTM) algorithm. This experimentation considers the recognition of a phished email as a classification issue. According to the comparison and implementation, SVM, NB and LSTM performance is better and more accurate to detect email phishing attacks. The classification of email attacks using SVM, NB, and LSTM classifiers achieve the highest accuracy of 99.62%, 97% and 98%, respectively.

It Won’t Happen to Me: Surveying SME Attitudes to Cyber-security

ABSTRACT We report an online survey of 85 U.K-based SMEs that explored their threat and coping appraisals toward five common types of cyber-attack: Network being hacked; Data being stolen or encrypted; malware infection; mobile devices being compromised; and phishing e-mail attack. Overall, SMEs’ reported assessment of the risk of an attack was low, particularly for the possibility of their business network being hacked or their data being stolen or encrypted. However, there was an incongruence in their Threat Appraisals since, while they believed the risks to be low, they reported that the impact would be high. In terms of Coping Appraisal, respondents indicated that measures to prevent such attacks were both inexpensive and effective. However, their reported self-efficacy was significantly lower for keeping mobile devices safe and avoiding phishing attacks. We discuss these results taking into consideration additional qualitative data and provide recommendations for SME engagement.

Improving spam email detection using deep recurrent neural network

<span>Nowadays the entire world depends on emails as a communication tool. Spammers try to exploit various vulnerabilities to attack users with spam emails. While it is difficult to prevent spam email attacks, many research studies have been developed in the last decade in an attempt to detect spam emails. These studies were conducted using machine learning techniques and various types of neural networks. However, with all their attempts the highest accuracy acquired was 94.2% by random forest classifier. Deep learning techniques have demonstrated higher accuracy performance compared to the traditional machine learning algorithms. In this paper, deep recurrent neural network was used to determine whether an email is a spam email. After investigating different configurations for this method, the best setting that generated the highest accuracy was based on using Tanh as the activation function with the dropout rate equals to 0.1 and the number of epochs achieving 100. The proposed approach attained a high accuracy of 99.7% which surpassed the best accuracy (98.7%) obtained by the hybrid gated recurrent unit recurrent neural network approach.</span>

How Good Are We at Detecting a Phishing Attack? Investigating the Evolving Phishing Attack Email and Why It Continues to Successfully Deceive Society

Phishing attacks are on the increase. The fact that our ways of living, studying and working have drastically changed as a result of the COVID pandemic (i.e., almost everything being done online) has created many new cyber security concerns. In particular, with the move to remote working, the number of phishing emails threatening employees has increased. The 2020 Phishing Attack Landscape Report (Greathorn: 2020 Phishing attack landscape. https://info.greathorn.com/report-2020-phishing-attack-landscape/, 2020) highlights a sharp increase in the frequency of attempted phishing attacks. In this paper, we are interested in how the phishing email attack has evolved to this very threatening state. In detail, we explore the current phishing attack characteristics especially the growing challenges that have emerged as a result of the COVID-19 pandemic. The paper documents a study that presented test participants with five different categories of emails (including phishing and non phishing) . The findings from the study show that participants, generally, found it difficult to detect modern phishing email attacks. Saying that, participants were alert to the spelling mistakes of the older phishing email attacks, sensitive information being requested from them and any slight change to what they were normally used to from an email. Moreover, we have found that people were not confident, worried and often dissatisfied with the current technologies available to protect them against phishing emails. In terms of trust, these feelings alerted us to the increasing severity of the phishing attack situation and just how vulnerable society has become/ still is.

Cyber Security Risk Assessment

The COVID-19 pandemic has accelerated the digitization of business processes, remote work/ access to sensitive data and critical corporate resources. There is a fast expansion of cloud computing services. The cybercrime follows the same trend: the sudden rise of global ransomware attacks, theft and disclosure of personal data, attacks on news sites, phishing email attacks, etc. The cybercrime increase reported since the beginning of the pandemic is about 300%. As a result, cyber security has become very important for all organizations,of all types and sizes. This paper aims to elucidate modern trends in the assessment and treatment of cyber security risks of an entity, automatize the cyber security processes to remove repetitive tasks and reduce the influence of the human factor.

Classification of Attack Types and Analysis of Attack Methods for Profiling Phishing Mail Attack Groups

In recent years, there has been an increase in the number of phishing attacks targeting people in the fields of defense, security, and diplomacy around the world. In particular, hacking attack group Kimsuky has been conducting phishing attacks to collect key information from public institutions since 2013. The main feature of the attack techniques used by the Kimsuky attack group are to conceal malicious code in phishing e-mails disguised as normal e-mails to spread a document file that is vulnerable to security, such as a Hangul file, or to induce interest through a social engineering attack technique to collect account information. This study classified the types of phishing e-mail attacks into spoofed e-mails, e-mail body vulnerability use, and attached file spoofing, and detailed analyses of their attack methods, such as commonality and characteristic analyses, were performed to analyze the profile of this phishing e-mail attack group. Based on the results, the purpose of the attacking group was determined to be intelligence gathering because it focused on phishing attacks targeting Korean diplomatic and defense public institutions and related foreign institutions. Finally, a countermeasure that can be used by mail service providers and mail users to respond to phishing e-mails is suggested.

An Unsupervised Approach for Content-Based Clustering of Emails Into Spam and Ham Through Multiangular Feature Formulation

The rapid growth of spam email attacks and the inherent malicious dynamism within those attacks on a range of social, personal and business activities warrants an intelligent and automated anti-spam framework. Attempts like malware propagation, identity theft, sensitive data pilfering, monetary as well as reputational damage are sharply increasing, endangering the privacy of the victim. Current solutions that are rather incomplete when the multidimensional feature range of email, is taken into account. We believe a methodology based on Artificial Intelligence, especially unsupervised machine learning is the way forward. This research attempts to investigating the application of unsupervised learning for the clustering of Spam and Ham emails. The overall goal of the research is to develop an unsupervised framework that solely depends on unsupervised methodologies through a clustering approach that includes multiple algorithms, primarily using the email content (body) and the subject header. The clustering has been done on a novel binary dataset of 22,000 entries of ham and spam emails, composed of ten features (reduced from eleven to ten after the feature reduction). Seven out of these ten features are unique to this study, engineered to represent impactful analytical email characteristics from a multiangular point of view. Out of five different clustering algorithms investigated in this work, OPTICS produced the optimum clustering demonstrating a 0.26% higher average efficacy than its nearest performer DBSCAN. The average balanced accuracy for OPTICS and DBSCAN was found to be ≈75.76%.

Leveraging Machine Learning Techniques to Identify Deceptive Decoy Documents Associated With Targeted Email Attacks

Detecting and preventing targeted email attacks is a long-standing challenge in cybersecurity research and practice. A typical targeted email attack capitalizes on a sophisticated email message to persuade a victim to run a specific, seemingly innocuous, action such as opening a link or an attachment and downloading and installing a software program. To successfully perform such an attack without being noticed afterwards, the attached exploit documents (hereafter referred to as decoy documents ), must contain content that is highly relevant to the target. An analysis of such decoy documents can provide crucial information for inferring and identifying the targeted or potentially harmed victims. In this paper, we propose an automatic approach that leverages natural language processing and machine learning to identify decoy documents that have a high chance of deceiving the targeted users. The experimental results show that the proposed method provides good prediction accuracy: the best result obtained on a collection of 200 Chinese decoy documents yielded an accuracy of 97.5%, an F-measure of 97.9% and a low FPR of 3.1%. The proposed scheme can be deployed at various access points to fortify the defense against targeted email attacks that threaten various targets.

Analysis of phishing emails

<abstract> This research aims to describe and analyze phishing emails. The problem of phishing, types of message content of phishing emails, and the basic techniques of phishing email attacks are explained by way of introduction. The study also includes a review of the relevant literature on Web of Science and analyzes articles that deal with the threat of phishing attacks and defense against them. Data collected within a time interval of two months from two email accounts of one of the authors of the study was used for the analysis of 200 email messages. Data has been resented in tabular form, to allow further statistical processing using functions such as sum, average and frequency analysis. The core part of the study involved the classification and segmentation of emails according to the main goals of the sent message. The text analytical software Tovek, was used for the analysis, Contribution of the manuscript is in the understanding of phishing emails and extending the knowledge base in education and training in phishing email defense. The discussion compares the results of this research with those of the studies mentioned in the "Introduction" and "Literature review" sections. Furthermore, the emerging problems and limitations of the use of text analytical software are described, and finally the issue is devoted to problems with obtaining personal data from recipients' emails. The "Conclusion" section summarizes the contributions of this research. </abstract>

How to prepare for the onslaught of phishing email attacks

Phishing email attacks are one of the biggest cyber security threats of our time, increasing exponentially year on year. Alarmingly we've seen attacks from phishing emails go up by nearly 700% compared to last year. 1 Cyber criminals are taking advantage of the huge potential for human error within any business, where one accidental click on a phishing email can allow access into entire corporate networks, a costly mistake to make. Cyber criminals are taking advantage of the potential for human error, where one click on a phishing email can allow access into corporate networks. Every business must have processes in place to cope with a potential phishing attack. Stephen Burke of Cyber Risk Aware looks at four key steps organisations can take to protect themselves. By ensuring that the correct infrastructure and technology is in place, combined with effective cyber security awareness training, businesses will be prepared to protect their networks.

Analisa Dan Implementasi Security Mail Server

Mail server is one of the most widely used server functions in the company. This discusses e-mail itself which can reduce mailing costs, is more efficient than manual communication and can be used as attachments that are useful as a supplement and additional documents related to the contents of e-mail. Zimbra is a mail server application that provides complete features and also makes it easy to install mail server management, also mail server security issues are a factor that must be considered by the system administrator. The security design for e-mail servers addresses the importance of being able to prevent spam e-mail attacks that can fill e-mail servers and make mail server performance faster. Because a good mail server security can optimize the performance of the mail server itself. In this final project, the work and implementation of the zimbra mail server security will be carried out specifically for handling email spam. The zimbra email server will analyze its security against spam email attacks, so that it can function as an email server on the company.