Email Attacks Research Articles

A New Approach to Quantifying, Reducing and Insuring Cyber Risk: Preliminary Analysis and Proposal for Further Research

Few would dispute that cyber risk is a very serious problem for the global economy and for society. But there is a “disconnect” between acknowledgement of the problem and action to address the problem. What is the relationship between vulnerabilities, preventive measures, and security incidents, like the leaking of sensitive data (say credit card information) to the web? To the best of our knowledge, little if anything is known about the relationship among these variables and no one has examined this issue empirically at the micro level, that is, at the level of the firm. In this paper, we put together a remarkable and unique cross-sectional data set at the firm level that includes information on vulnerabilities, attempted email attacks, incidents (breaches), precautions (security measures.) and firm characteristics. The data set contains slightly under 1000 small and medium firms in the U.K. We empirically examine the data and show that there are meaningful correlations among incidents and the other variables. Finally, we estimate a reduced form model with incidents as the dependent variable to illustrate the potential from employing such data.

From Feature Engineering and Topics Models to Enhanced Prediction Rates in Phishing Detection

Phishing is a type of fraud attempt in which the attacker, usually by e-mail, pretends to be a trusted person or entity in order to obtain sensitive information from a target. Most recent phishing detection researches have focused on obtaining highly distinctive features from the metadata and text of these e-mails. The obtained attributes are then used to feed classification algorithms in order to determine whether they are phishing or legitimate messages. In this paper, it is proposed an approach based on machine learning to detect phishing e-mail attacks. The methods that compose this approach are performed through a feature engineering process based on natural language processing, lemmatization, topics modeling, improved learning techniques for resampling and cross-validation, and hyperparameters configuration. The first proposed method uses all the features obtained from the Document-Term Matrix (DTM) in the classification algorithms. The second one uses Latent Dirichlet Allocation (LDA) as a operation to deal with the problems of the “curse of dimensionality”, the sparsity, and the text context portion included in the obtained representation. The proposed approach reached marks with an F1-measure of 99.95% success rate using the XGBoost algorithm. It outperforms state-of-the-art phishing detection researches for an accredited data set, in applications based only on the body of the e-mails, without using other e-mail features such as its header, IP information or number of links in the text.

The Answer is in the Text: Multi-Stage Methods for Phishing Detection Based on Feature Engineering

A phishing attack is a threat based on fraudulent communication, usually by e-mail, where the cybercriminals, impersonating a trusted person or organization, try to lure and coax a target. Phishing detection approaches that obtain highly representational features from the text of these e-mails are a suitable strategy to counter these threats since these features can be used to train machine learning algorithms, thus generating models able to classify mail samples as phishing or legitimate messages. This paper proposes a multi-stage approach to detect phishing e-mail attacks using natural language processing and machine learning. The proposed multi-stage approach consists of feature engineering within natural language processing, lemmatization, feature selection, feature extraction, improved learning techniques for resampling and cross-validation, and the configuration of hyperparameters. We present two methods of the proposed approach, the first one exploiting the Chi-Square statistics and the Mutual Information to improve the dimensionality reduction, while the second method associates Principal Component Analysis (PCA) and Latent Semantic Analysis (LSA). Both methods handle the problems of the “curse of dimensionality”, the sparsity, and the amount of information that must be obtained from the context in the Vector Space Model (VSM) representation. These methods yield reduced feature sets that, combined with the XGBoost and Random Forest machine learning algorithms, lead to an F1-measure of 100% success rate, for validation tests with the SpamAssassin Public Corpus and the Nazario Phishing Corpus datasets. Even considering just the text in e-mail bodies, the proposed multi-stage phishing detection approach outperforms state-of-the-art schemes for an accredited data set, requiring a much smaller number of features and presenting lower computational cost.

Effects of Anthropomorphic Phishing Detection Aids, Transparency Information, and Feedback on User Trust, Performance, and Aid Retention

Phishing email attacks are a prevalent threat to internet users. Users often ignore or otherwise disregard automated aids, even when the aids’ reliability is high. The current study sought to fill a gap in the literature by examining the effects of anthropomorphism, feedback, and transparency information on user trust and performance within the domain of phishing email detection. Based upon previous studies in anthropomorphic automated systems, this study incorporated three levels of anthropomorphism (AI, human, text), two levels of aid gender (male, female), transparency information (present, absent), and feedback (present, absent). The 465 participants were recruited online through Amazon Mechanical Turk (MTurk) and performed the study on Qualtrics. Phishing was explained and instructions told the participants to judge whether the following emails are legitimate or phishing in three separate blocks of five emails. The first block was without any automated aid as a baseline of participants’ performance. The second block showed participants their respective aid and had them complete five more emails with the aid. The final block allowed participants to choose if they wanted to keep the aid or classify the emails alone. Afterwards, participants were asked how much they trusted the aid to help detect phishing threats using a trust in automation scale based on Jian, Bisantz, and Drury's (2000) study. Our results revealed improved performance on the phishing detection task for participants with an aid over participants without an aid. In addition, feedback was shown to be helpful for improving judgement accuracy as well as increase trust. Transparency also improved judgement accuracy for the human aid but was less helpful for the AI aid. This study compliments past research indicating improvements in performance with automated aids (Chen et al., 2018; Röttger, Bali, & Manzey, 2009; Wiegmann, Rich, & Zhang, 2001). Performance in blocks 2 and 3 was better than block 1. A significant positive correlation between trust and performance reinforces that high trust in a highly reliable aid begets good performance. Subsequently, if participants did not retain the aid for block 3, their performance was worse than those who retained the aid. Designers of automated aid systems should prioritize users interacting with and using the aid so that performance stays high. Feedback also helped improve judgement accuracy. By allowing participants to understand the reliability of the aid, they could learn to trust it more and rely on the suggestions of the aid. Feedback information should be offered to users if possible because it helps improve trust and performance, which is the goal of any automated aid system. Human aids with transparency information helped improve performance compared to human aids without transparency information. But this effect was not found for AI aids and nearly reversed. Transparency was expected to improve trust and performance (Hoff & Bashir, 2015), but it showed no differences in trust and only improved performance for human aids. This new finding demonstrates that there could be differences in the perception of human and AI aids, although further experiments would need to be conducted to further examine these findings.

Result and Effectiveness of Malicious E-mail Response Training in a Hospital.

Malicious e-mails sent intentionally to institutions have caused an increase in data breaches. Measures against these methods must be taken by healthcare institutions to prevent leakage of sensitive personal medical information. As a form of training, we conducted a phishing simulation to gauge the response of the hospital staff to similar email attacks, and to raise awareness about information security protocols.

Presidential hopefuls vulnerable

The campaigns for nearly all top-tier candidates running for President of the United States in 2020 are unprotected against the kinds of email attacks, fraud and data breaches typically instigated by nation states, according to a new report from Agari.

Cybercrime Risks in a University Student Community

In an exploratory quasi-experimental observational study, 138 participants recruited during a university orientation week were exposed to social engineering directives in the form of fake email or phishing attacks over several months in 2017. These email attacks attempted to elicit personal information from participants, or entice them into clicking links which may have been compromised in a real-world setting. The study aimed to determine the risks of cybercrime for students by observing their responses to social engineering and exploring attitudes to cybercrime risks before and after the phishing phase. Three types of scam emails were distributed that varied the degree of individualization: generic, tailored and targeted or ‘spear’. To differentiate participants on the basis of cybercrime awareness, participants in a ‘Hunter’ condition were primed throughout the study to remain vigilant to all scams, while participants in a ‘Passive’ condition received no such instruction. The study explored the influence of scam type, cybercrime awareness, gender, IT competence, and perceived Internet safety on susceptibility to email scams. Contrary to the hypotheses, none of these factors were associated with scam susceptibility although tailored and individually crafted email scams were more likely to induce engagement than generic scams. Analysis of all the variables showed that international students and first year students were deceived by significantly more scams than domestic students and later year students. A Generalized Linear Model (GLM) analysis was undertaken to further explore the role of all the variables of interest and the results were consistent with the descriptive findings showing that student status (domestic compared to international) and year of study (first year student compared to students in second, third and later years of study) had a higher association to the risk of scam deception. Implications and future research directions are discussed.

Phishing and Cybercrime Risks in a University Student Community

In an exploratory quasi-experimental observational study, 138 participants recruited during a university orientation week were exposed to social engineering directives in the form of fake email or phishing attacks over several months in 2017. These email attacks attempted to elicit personal information from participants or entice them into clicking links which may have been compromised in a real-world setting. The study aimed to determine the risks of cybercrime for students by observing their responses to social engineering and exploring attitudes to cybercrime risks before and after the phishing phase. Three types of scam emails were distributed that varied in the degree of individualization: generic, tailored, and targeted or ‘spear.’ To differentiate participants on the basis of cybercrime awareness, participants in a ‘Hunter’ condition were primed throughout the study to remain vigilant to all scams, while participants in a ‘Passive’ condition received no such instruction. The study explored the influence of scam type, cybercrime awareness, gender, IT competence, and perceived Internet safety on susceptibility to email scams. Contrary to the hypotheses, none of these factors were associated with scam susceptibility. Although, tailored and individually crafted email scams were more likely to induce engagement than generic scams. Analysis of all the variables showed that international students and first year students were deceived by significantly more scams than domestic students and later year students. A Generalized Linear Model (GLM) analysis was undertaken to further explore the role of all the variables of interest and the results were consistent with the descriptive findings showing that student status (domestic compared to international) and year of study (first year student compared to students in second, third and later years of study) had a higher association to the risk of scam deception. Implications and future research directions are discussed.

Viable Email Attacks and a Simple End-to-End Security Solution

Many attacks, scams, and malware threats are based on or spread through emails nowadays. Although people have been fighting against them with technical and legal measures for many years, the situation has not improved. It seems to be getting worse and worse. We attribute this to lack of end-to-end security measures for emails in current internet infrastructure. Most past security solutions provide either in-domain authentication, or domain-to-domain authentication. Available end-to-end solutions are based on public key cryptography and have many limitations. In this paper, we propose a simple end-to-end solution for email security. It is based on the idea of trust chain from sender to receiver, which spans multiple domains and organizations without the requirement of a uniform platform. On the client-end, it is transparent to the user without requirement of any user operation. The solution provides end-to-end authentication and integrity for its users, which is hard to achieve or use in existing works.

Phishing and Spam: A Pilot Experiment

In an exploratory pilot study 61 participants recruited during a university orientation week were exposed to social engineering directives in the form of fake email attacks that attempted to elicit personal information. Participants in a ‘Hunter’ condition were asked to remain to remain vigilant and report any suspicious content to researchers in the ANU Cybercrime Observatory. Participants in the ‘Passive’ condition received no such instruction. The first two attacks replicated mass generic phishing attempts in which use of names, personal greetings, and personal information were absent. The first generic attack required participants to respond to the email with personal information, and the second attack provided a ‘compromised’ link for participants to click. The third attack that was launched simulated a spear phishing attempt. In this attempt, the fake emails were tailored with participants’ personal information obtained from social media in an attempt to entice participants to click links and enter personal details. The tailored emails impersonated trusted companies or contexts. As hypothesised participants were more susceptible to the specially targeted or spear phishing attacks than generic phishing attacks. ‘Hunter’ participants were more susceptible to all attacks compared to ‘Passive’ participants. This finding was contrary to our second hypothesis that alert participants would be more circumspect than those not so primed. “Hunter” participants however, were under-prepared and limited by a single instruction a few months prior to the dispatch of fake emails. Gender differences were also observed with females more likely to be susceptible in all conditions. The ease with which personal information was collected and potentially used against participants, combined with participants’ higher susceptibility to targeted attacks, makes spear phishing a continuing threat. Crime prevention awareness combined with basic knowledge about spear phishing methods can reduce the risk of deception.

Improving risk assessment model of cyber security using fuzzy logic inference system

This paper describes the impacts of criminal activities based on the nature of the crime, the victim, and the basis (whether short-term or long-range/term) of the impacts of cybercrime on Internet. Recently many countries are facing numerous cyber threats including DoS (and DDoS), malware, website defamation, spam and phishing email attacks. Due to these cybercrimes evolution, identifying and assessing security risk is crucial to access data from new technologies, and also trying to understand how technologies can be abused. Therefore, there is a need to develop a special cyber security risk assessment model to tackle over these cyber threats. In this paper, we propose to utilize Fuzzy Inference Model (FIS) to produce risk assessment result based on the four risk factors which are: vulnerability, threat, likelihood and impact to specify the range of risks that can threaten any entity and try to solve such issues to proposed entities. We have performed various analyses on this factors and finally, our evaluation results show the viability of our proposed approach.

Spam E-mail Filtering using ECOS Algorithms

Spam known as Unsolicited Bulk E-mail (UBE) including undesirable electronic correspondence that is sent in bulk to massive mailing lists, sometimes with some business nature sent get into bulk. One of the main problems of spam E-mail detection is an attack from an unknown source known as ‘zero-day’ so named due to continued changes in timing. Zero day attacks are problematic for having the ability to escape spamming detection as the hosts do not show up in blacklists. This adds to the problem of False positives and OCR computational cost especially in dealing with a huge corpus of texts with images that run through server-side filters. Spammers are busy orchestrating various representation techniques thus making their ‘zero-day’ spam E-mail that infiltrate the defenses of detection. Our proposed is a novel system called Spamming Dynamic Evolving Neural Fuzzy System (SDENFS), which adapts the Evolving Connectionist System (ECoS) based on a hybrid (supervised/unsupervised) learning approach. SDENFS adaptive online is enhanced by offline learning to detect dynamically the spamming E-mail included unknown zero-day spamming E-mails before it get to user account. SDENFS is suggested to work for high-speed “life-long” learning with low memory footprint with few number of rules creation for E-mail classification. Two datasets composed of 6612 samples of spam and legitimate E-mails were used to assess the proposed system. The proposed system showed a high level of performance in detecting spam E-mail attacks. The average of the accuracy and F-measure of the classification process was 99%.

Natural Language Processing Technologies for Multi-Level Intelligent Spam Mail-Filter

To overcome the lack of existing mail filtering system, we designed a content-based message filtering system of multi-level intelligence. Using natural language processing technology, it denotes the E-mail content including attachments. First, it pre-processes the content of E-mail, including segmentation, feature extraction. Second, combining knowledge-base and expansion of the feature, it can form the vector. Corresponding categories vector in the database, two vectors similar degree of calculation determines the credibility of the message. Based on the above theory, with the Java EE 6+SQL Server 2005 platform, a mail filtering system is achieved. It can maximize the elimination of spam. The major features are following: 1) black /white list filtering. It can intercept white list blacklist e-mail messages released. 2) reverse DNS testing. it can effectively eliminate the anonymous e-mail attacks. 3) content-based message filtering. An accurate analysis of mail content can filter out suspicious messages. 4) fingerprint recognition. It can mimic the biological concept of fingerprint identification to complete the identification of spam. 5) user-personalized filtering. The user independently designed filter program. 6) intent detection. It can detect the content URL connection in email. Experiment shows mail filter system can play a very good effect on spam filters.

Review Paper on Privacy Preservation through Phishing Email Filter

Phishing is the combination of social engineering and technical exploits designed which creates a replica of an existing Web page to fool users (e.g., by using specially designed e-mails or instant messages) into submitting sensitive information such as online banking passwords and credit card details, personal and financial information by masquerading as a trustworthy entity in an electronic communication. Phishing is a new type of network attack which constitutes more than half of all security incidents on the internet. Email based online phishing is critical security thread on the internet. More and more user are suffering from email based phishing attack over a last few year. Phishing email contains messages to lure victims into performing certain action, such as clicking on URL where phishing site is hosted. This paper present overview about phishing email attack, its classification and preventing approaches. Email phishing attacks fabricate the email's origin. Unfortunately, current email server systems cannot authenticate the genuineness of incoming emails. feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to deceive users, and exploits the poor usability of current web security technologies. Attempts to deal with the growing number of reported phishing incidents include legislation, user training, public awareness, and technical security measures. The word 'Phishing' initially emerged in 1990s. The early hackers often use 'ph' to replace 'f' to produce new words in the hacker's community, since they usually hack by phones. Phishing is a new word produced from 'fishing', it refers to the act that the attacker allure users to visit a faked Web site by sending them faked e-mails (or instant messages), and stealthily get victim's personal information such as user name, password, and national security ID, etc. These information then can be used for future target advertisements or even identity theft attacks (e.g., transfer money from victims' bank account) (15).

Visual analytics for intrusion detection in spam emails

Spam email attacks are increasing at an alarming rate and have become more and more cunning in nature. This has necessitated the need for visual spam email analysis within an intrusion detection system to identify these attacks. The challenges are how to increase the accuracy of detection and how to visualise large volumes of spam email to better understand the analysis results and identify email attacks. This paper proposes a Density-Weight model that is to strengthen and extend the system capacity for analysis of network attacks in spam emails, including DDoS attacks. An interactive visual clustering method DA-TU is introduced to classify and display spam emails. The experimental results have shown that the proposed new model has improved the accuracy of intrusion detection and provides a better understanding of the nature of spam email attacks on though the network.

A Survey of Phishing Email Filtering Techniques

Phishing email is one of the major problems of today's Internet, resulting in financial losses for organizations and annoying individual users. Numerous approaches have been developed to filter phishing emails, yet the problem still lacks a complete solution. In this paper, we present a survey of the state of the art research on such attacks. This is the first comprehensive survey to discuss methods of protection against phishing email attacks in detail. We present an overview of the various techniques presently used to detect phishing email, at the different stages of attack, mostly focusing on machine-learning techniques. A comparative study and evaluation of these filtering methods is carried out. This provides an understanding of the problem, its current solution space, and the future research directions anticipated.

A novel approach against E-mail attacks derived from user-awareness based techniques

A large part of modern day communications are carried out through the medium of E-mails, especially corporate communications. More and more people are using E-mail for personal uses too. Companies also send notifications to their customers in E-mail. In fact, in the Multinational business scenario E-mail is the most convenient and sought-after method of communication. Important features of E-mail such as its speed, reliability, efficient storage options and a large number of added facilities make it highly popular among people from all sectors of business and society. But being largely popular has its negative aspects too. E-mails are the preferred medium for a large number of attacks over the internet. Some of the most popular attacks over the internet include spams, and phishing mails. Both spammers and phishers utilize E-mail services quite efficiently in spite of a large number of detection and prevention techniques already in place. Very few methods are actually good in detection/prevention of spam/phishing related mails but they have higher false positives. A variety of filters such as Bayesian filters, Checksum-based filters, machine learning based filters and memory-based filters are usually used in order to identify spams. These techniques are implemented at the server and in addition to giving higher number of false positives, they add to the processing load on the server. This paper outlines a novel approach to detect not only spam, but also scams, phishing and advertisement related mails. In this method, we overcome the limitations of server-side detection techniques by utilizing some intelligence on the part of users. Keywords parsing, token separation and knowledge bases are used in the background to detect almost all E-mail attacks. The proposed methodology, if implemented, can help protect E-mail users from almost all kinds of unwanted mails with enhanced efficiency, reduced number of false positives while not increasing the load on E-mail servers.

Performance analysis of email systems under three types of attacks

Email is a crucial part of our daily life, but email systems are facing increasing security threats such as attacks and spam. Because of this, new mechanisms are being provided to defend against the attacks and to reduce the amount of spam in email systems. Up to now, few available works have been reported on the performance evaluation of email systems under attack, which has become necessary for enhancing email security. In this paper, we propose a novel method to study the impact of three types of attacks on email systems. We construct a multiple queueing model to characterize three types of attacks integrally, and study the performance metrics of system security such as system availability, average queue length and information leakage probability. Numerical examples indicate that the approach of this paper is effective and efficient for dealing with the security analysis of email systems under attack. We believe that this work will open a new avenue for the performance evaluation of computer networks under email attack and other forms of attacks.

Toward a sustainable email marketing infrastructure

Email marketing is a legitimate, lucrative, and widely used business tool that is in danger of being overrun by unwanted commercial email (also known as spam). Conventional approaches to maintaining the robustness of legitimate email attack pieces of the problem. In contrast, this article asserts that the email marketing infrastructure is a complex system requiring holistic analysis. In order to understand the underlying dynamics of the spam industry and to examine alternative mitigation strategies, the article develops a system dynamics model. The modeling process reveals that the system conforms to the limits-to-growth generic structure. Simulations suggest that filtering may have the unintended consequence of increasing the global amount of spam. The unexpected increase comes about because better filters can actually assist spammers by abating an information deficit.

Instant messaging: a new target for hackers

Instant messaging is exploding as a means of personal and corporate communications. Individuals chat via IM; companies rely on beefed-up versions of the technology, with its real-time capabilities, for collaborative design work; and e-businesses use IM to provide live, immediate customer service to shoppers. Meanwhile, the technology is finding its way onto mobile devices, including PDAs and smart phones. However, as IM becomes more popular, particularly for businesses, it has also increasingly become the target of attacks, such as those using malicious code and phishing. Some security experts say IM is following the same patterns shown during the development of e-mail attacks. These include the use of tricks to encourage victims to click on virus-laden attachments or hyperlinks to Web pages that upload applets to either infect visitors with malware or drop unwanted software on their computers. The most dangerous part about the attacks is their speed of propagation, caused by IM's real-time capabilities. Traditional antivirus technology, in which vendors typically need 24 hours to find remedies for new malicious code, may be too slow to prevent many IM attacks from spreading rapidly.