Phishing Activities Research Articles

Phishing behavior detection on different blockchains via adversarial domain adaptation

Despite the growing attention on blockchain, phishing activities have surged, particularly on newly established chains. Acknowledging the challenge of limited intelligence in the early stages of new chains, we propose ADA-Spear-an automatic phishing detection model utilizing adversarial domain adaptive learning which symbolizes the method’s ability to penetrate various heterogeneous blockchains for phishing detection. The model effectively identifies phishing behavior in new chains with limited reliable labels, addressing challenges such as significant distribution drift, low attribute overlap, and limited inter-chain connections. Our approach includes a subgraph construction strategy to align heterogeneous chains, a layered deep learning encoder capturing both temporal and spatial information, and integrated adversarial domain adaptive learning in end-to-end model training. Validation in Ethereum, Bitcoin, and EOSIO environments demonstrates ADA-Spear’s effectiveness, achieving an average F1 score of 77.41 on new chains after knowledge transfer, surpassing existing detection methods.

PhishHunter: Detecting camouflaged IDN-based phishing attacks via Siamese neural network

Phishing is one of the significant threats to cybersecurity today, especially when attackers create Internationalized Domain Names (IDN) homographs to engage in phishing activities. IDN homograph takes advantage of some characters in different native languages in internationalized domain names that look similar to legitimate ones. Although researchers have proposed several enlightening detection methods, most of them focused on detecting typosquatting domain names. The ones focused on IDN homograph attack detection either need to enhance the generalization ability or improve detection performance caused by data imbalance. In this paper, we devised a Generative Adversarial Network with a Gradient Penalty (WGAN-GP) algorithm to solve the data imbalance problem. We transform domain names into images and calculate their similarity by Siamese neural networks. Our work can identify whether a domain name is IDN homograph or not effectively. We use the dataset generated based on Unicode tables, publicly available homograph tools, and the Internet traffic captured from the China Education Research Network backbone (CERNET) to evaluate the performance. Experimental results show that the proposed method improves the accuracy and reduces the false positive rate in detecting homograph domain names. In addition, it can also accurately identify typosquatting in phishing pages.

Understanding phishing awareness among students in tertiary institutions and setting-up defensive mechanisms against the attackers

The average loss by companies to phishing in 2021 is $14.8 million, more than triple what it was in 2015. That translates to hundreds of billions of dollars in total losses from phishing attacks on global businesses, and the vulnerability of these attacks is every day increasing, particularly among the younger generation less than 40 years of age. This paper begins with a background exposition on phishing trends and highlights previous findings concerning users' susceptibility to phishing attacks. It however explores the term Phishing itself, its kinds, types and some basic measures necessary for defense against phishing activities. The research was employed with a major focus on the email aspect of phishing. Alongside the website aspect of phishing, the certificate of a website was also considered. The purpose of this study was to identify the level of student awareness related to specific phishing tactics. Findings revealed that while students are unlikely to provide personal information in response to an email/SMS request, they can be easily tricked by numerous other tactics. This paper reports the findings of the study in addition to listing suggested points to employ for creating phishing awareness.

Spam Mail Classifier

Abstract: Email is the worldwide use of communication application. It is because of the ease of use and faster than other communication application. However, its inability to detect whether the mail content is either spam or ham degrade its performance. Nowadays, lot of cases have been reported regarding stealing of personal information or phishing activities via email from the user. This project will discuss how machine learning help in spam detection. Machine learning is an artificial intelligence application that provides the ability to automatically learn and improve data without being explicitly programmed. Binary classifierwill be used to classify the text into two different categories: spam and ham. The algorithm will predict the score more accurately. The objectiveof developing this model is to detect and score word faster and accurately.

Implementation of Blowfish Algorithm for Encryption and Decription on Android-Based QR Code

The development of technology is currently growing very rapidly which allows us to access various kinds of data and information, but there are lots of people who abuse this ability, for example phishing activities that often target data and information owned by individuals and companies. Loss of data and information is very detrimental to individuals and companies, where the data and information can be used as a tool for extortion, used as a fraud tool and even the information can be traded. The main reason for the importance of maintaining the security of information is to protect information from online crimes. One of the techniques designed to protect important and confidential information is a cryptographic technique using the Blowfish algorithm and also a QR Code which functions as second line security. where data and information that has been converted into a QR Code cannot be changed. The purpose of this study is to apply the Blowfish Algorithm for Encryption and Decryption of the QR Code into an android-based application system. The results of this study are: The blowfish algorithm can be implemented into an android-based application. Plaintext which is converted into ciphertext using the blowfish algorithm can be used as a QR Code using a QR Code generator. A QR code is up to 7089 numeric digits and 4296 alphanumeric characters. The amount of information will affect the QR Code module, so the symbols in the QR Code will become more complicated. This application has received an assessment from respondents from users with an average value (6.5) with the category of choice "agree".

5D Gauss Map Perspective to Image Encryption with Transfer Learning Validation

Encryption of visual data is a requirement of the modern day. This is obvious and greatly required due to widespread use of digital communication mediums, their wide range of applications, and phishing activities. Chaos approaches have been shown to be extremely effective among many encryption methods. However, low-dimensional chaotic schemes are characterized by restricted system components and fundamental structures. As a result, chaotic signal estimation algorithms may be utilized to anticipate system properties and their initial values to breach the security. High-dimensional chaotic maps on the other hand, have exceptional chaotic behavior and complex structure because of increased number of system parameters. Therefore, to overcome the shortcomings of the lower order chaotic map, this paper proposes a 5D Gauss Map for image encryption for the first time. The work presented here is an expansion of the Gauss Map’s current 1D form. The performance of the stated work is evaluated using some of the most important metrics as well as the different attacks in the field. In addition to traditional and well-established metrics such as PSNR, MSE, SSIM, Information Entropy, NPCR, UACI, and Correlation Coefficient that have been used to validate encryption schemes, classification accuracy is also verified using transfer learning. The simulation was done on the MATLAB platform, and the classification accuracy after the encryption-decryption process is compared.

Spam detection by using machine learning based binary classifier

<span lang="EN-US">Because <span lang="EN-US">of its ease of use and speed compared to other communication applications, email is the most commonly used communication application worldwide. However, a major drawback is its inability to detect whether mail content is either spam or ham. There is currently an increasing number of cases of stealing personal information or phishing activities via email. This project will discuss how machine learning can help in spam detection. Machine learning is an artificial intelligence application that provides the ability to automatically learn and improve data without being explicitly programmed. A binary classifier will be used to classify the text into two different categories: spam and ham. This research shows the machine learning algorithm in the Azure-based platform predicts the score more accurately compared to the machine learning algorithm in visual studio, hybrid analysis and JoeSandbox cloud.</span></span>

Phishing as a form of fraud identity theft in healthcare: Victimization during COVID-19 pandemic

The coronavirus pandemic affects all segments of human life around the world. Due to the risk to people's health, personal communication has been completely changed and most professional activities and contacts must take place in a cyber environment, with the help of computers and mobile telephony. On-line communication and the use of social networks undoubtedly represent a conditio sine qua non in a situation when compliance with numerous preventive measures are required, including the work from home, online teaching in schools, a ban on gatherings etc. The positive aspects of this kind of communication are undoubtedly obvious and necessary, but they also created new forms of victimization due to insecure protocols for sending e-mails, inadequate level of privacy protection, insufficient information security, the existence of so-called security holes and the use of the same devices and digital services for professional and private purposes. Hacking phishing activities during the pandemic mostly endangered the security of confidential data collected within medical information systems, educational institutions, and in the field of banking, when the user is expected to compromise his/her digital identity and publish his/her data. The subject of this paper is the presentation of some of the most common phishing activities and identity theft in the field of health care, provision of health services, procurement of medicines and vaccines against coronavirus, which have been recorded in the world since the beginning of the pandemic. The phishing activities that will be presented in this paper significantly contribute to the further spread of panic from the misuse of medical data of infected persons and their contacts. The paper aims to point out the most common forms of victimization that have appeared around the world, as a consequence of cyber security violations due to hacker attacks during the COVID- 19 pandemic. Special emphasis in the paper is on these ?pandemic? cyber dangers, as well as on the mechanisms for avoiding this type of victimization.

The Vulnerabilities of Trusted Notifier-Models in Russia: The Case of Netoscope

Current digital ecosystems are shaped by platformisation, algorithmic recommender systems, and news personalisation. These (algorithmic) infrastructures influence online news dissemination and therefore necessitate a reconceptualisation of how online media control is or may be exercised in states with restricted media freedom. Indeed, the degree of media plurality and journalistic independence becomes irrelevant when reporting is available but difficult to access; for example, if the websites of media outlets are not indexed or recommended by the search engines, news aggregators, or social media platforms that function as algorithmic gatekeepers. Research approaches to media control need to be broadened because authoritarian governments are increasingly adopting policies that govern the internet <em>through</em> its infrastructure; the power they leverage against private infrastructure owners yields more effective—and less easily perceptible—control over online content dissemination. Zooming in on the use of trusted notifier-models to counter online harms in Russia, we examine the Netoscope project (a database of Russian domain names suspected of malware, botnet, or phishing activities) in which federal censor Roskomnadzor cooperates with, e.g., Yandex (that downranks listed domains in search results), Kaspersky, and foreign partners. Based<strong> </strong>on publicly available reports, media coverage, and semi-structured interviews, the article analyses the degree of influence, control, and oversight of Netoscope’s participating partners over the database and its applications. We argue that, in the absence of effective legal safeguards and transparency requirements, the politicised nature of internet infrastructure makes the trusted notifier-model vulnerable to abuse in authoritarian states.

Phishing Webpage Classification via Deep Learning-Based Algorithms: An Empirical Study

Phishing detection with high-performance accuracy and low computational complexity has always been a topic of great interest. New technologies have been developed to improve the phishing detection rate and reduce computational constraints in recent years. However, one solution is insufficient to address all problems caused by attackers in cyberspace. Therefore, the primary objective of this paper is to analyze the performance of various deep learning algorithms in detecting phishing activities. This analysis will help organizations or individuals select and adopt the proper solution according to their technological needs and specific applications’ requirements to fight against phishing attacks. In this regard, an empirical study was conducted using four different deep learning algorithms, including deep neural network (DNN), convolutional neural network (CNN), Long Short-Term Memory (LSTM), and gated recurrent unit (GRU). To analyze the behaviors of these deep learning architectures, extensive experiments were carried out to examine the impact of parameter tuning on the performance accuracy of the deep learning models. In addition, various performance metrics were measured to evaluate the effectiveness and feasibility of DL models in detecting phishing activities. The results obtained from the experiments showed that no single DL algorithm achieved the best measures across all performance metrics. The empirical findings from this paper also manifest several issues and suggest future research directions related to deep learning in the phishing detection domain.

Light gradient boosting machine-based phishing webpage detection model using phisher website features of mimic URLs

With the advent of the 20th century, the popularity of digital service usages is increasing every day. The internet has always been a popular communication method, and phishing webpages have been a challenging issue for more than two decades. Especially, E-commerce and other global companies face enormous challenges due to phishing of websites. Many developed countries have reported substantial economic loss due to unwanted phishing activities. With the exponential increase of digital communications, these phishing activities are going to be increased. There is a need for an effective intrinsic phishing detection technique. Phishing websites have some unique features by which they can be identified. In this research, a Light gradient boosting machine-based phishing email detection model using phisher websites' features of mimic URLs has been proposed. The primary objective is to develop a highly secured and accurate model for successful identification of security breach through websites phishing. With the performance comparison of other ensemble as well as state-of-the-art machine learning models, the proposed model resulted high performance accuracy and proved to a robust approach for phishing activity.

Similarity measure fuzzy soft set for phishing detection

Phishing is a serious web security problem, and the internet fraud technique involves mirroring genuine websites to trick online users into stealing their sensitive information and taking out their personal information, such as bank account information, usernames, credit card, and passwords. Early detection can prevent phishing behavior makes quick protection of personal information. Classification methods can be used to predict this phishing behavior. This paper presents an intelligent classification model for detecting Phishing by redefining a fuzzy soft set (FSS) theory for better computational performance. There are four types of similarity measures: (1) Comparison table, (2) Matching function, (3) Similarity measure, and (4) Distance measure. The experiment showed that the Similarity measure has better performance than the others in accuracy and recall, reached 95.45 % and 99.77 %, respectively. It concludes that FSS similarity measured is more precise than others, and FSS could be a promising approach to avoid phishing activities. This novel method can be implemented in social media software to warn the users as an early warning system. This model can be used for personal or commercial purposes on social media applications to protect sensitive data.

Hybrid Rule‐Based Solution for Phishing URL Detection Using Convolutional Neural Network

The phenomenon of phishing has now been a common threat, since many individuals and webpages have been observed to be attacked by phishers. The common purpose of phishing activities is to obtain user’s personal information for illegitimate usage. Considering the growing intensity of the issue, this study is aimed at developing a new hybrid rule‐based solution by incorporating six different algorithm models that may efficiently detect and control the phishing issue. The study incorporates 37 features extracted from six different methods including the black listed method, lexical and host method, content method, identity method, identity similarity method, visual similarity method, and behavioral method. Furthermore, comparative analysis was undertaken between different machine learning and deep learning models which includes CART (decision trees), SVM (support vector machines), or KNN (K‐nearest neighbors) and deep learning models such as MLP (multilayer perceptron) and CNN (convolutional neural networks). Findings of the study indicated that the method was effective in analysing the URL stress through different viewpoints, leading towards the validity of the model. However, the highest accuracy level was obtained for deep learning with the given values of 97.945 for the CNN model and 93.216 for the MLP model, respectively. The study therefore concludes that the new hybrid solution must be implemented at a practical level to reduce phishing activities, due to its high efficiency and accuracy.

AI Meta-Learners and Extra-Trees Algorithm for the Detection of Phishing Websites

Phishing is a type of social web-engineering attack in cyberspace where criminals steal valuable data or information from insensitive or uninformed users of the internet. Existing countermeasures in the form of anti-phishing software and computational methods for detecting phishing activities have proven to be effective. However, new methods are deployed by hackers to thwart these countermeasures. Due to the evolving nature of phishing attacks, the need for novel and efficient countermeasures becomes crucial as the effect of phishing attacks are often fatal and disastrous. Artificial Intelligence (AI) schemes have been the cornerstone of modern countermeasures used for mitigating phishing attacks. AI-based phishing countermeasures or methods possess their shortcomings particularly the high false alarm rate and the inability to interpret how most phishing methods perform their function. This study proposed four (4) meta-learner models (AdaBoost-Extra Tree (ABET), Bagging – Extra tree (BET), Rotation Forest – Extra Tree (RoFBET) and LogitBoost-Extra Tree (LBET)) developed using the extra-tree base classifier. The proposed AI-based meta-learners were fitted on phishing website datasets (currently with the newest features) and their performances were evaluated. The models achieved a detection accuracy not lower than 97% with a drastically low false-positive rate of not more 0.028. In addition, the proposed models outperform existing ML-based models in phishing attack detection. Hence, we recommend the adoption of meta-learners when building phishing attack detection models.

Phishlimiter: A Phishing Detection and Mitigation Approach Using Software-Defined Networking

Phishing is one of the most harmful social engineering techniques to subdue end users where threat actors find a chance to gain access to critical information systems. A common approach in phishing is through the use of e-mail communication with an embedded hyperlink. The detection and mitigation of phishing attacks are a grand challenge due to the complexity of current phishing attacks. Existing techniques are often too time consuming to be used in the real world in terms of detection and mitigation time. Likewise, they employ static detection rules that are not effective in the real world due to the dynamics of phishing attacks. In this paper, we present PhishLimiter, a new detection and mitigation approach, where we first propose a new technique for deep packet inspection (DPI) and then leverage it with software-defined networking (SDN) to identify phishing activities through e-mail and web-based communication. The proposed DPI approach consists of two components: phishing signature classification and real-time DPI. Based on the programmability of SDN, we develop the store and forward mode and the forward and inspect mode to the direct network traffic by using an artificial neural network model to classify phishing attack signatures and design the real-time DPI so that PhishLimiter can flexibly address the dynamics of phishing attacks in the real world. PhishLimiter also provides better network traffic management for containing phishing attacks since it has the global view of a network through SDN. Furthermore, we evaluate PhishLimiter using a real-world testbed environment and data sets consisting of real-world e-mail with embedded links. Our extensive experimental study shows that PhishLimiter provides an effective and efficient solution to deter malicious activities.

Phishing Detection: A Case Analysis on Classifiers with Rules Using Machine Learning

A typical predictive approach in data mining that produces If-Then knowledge for decision making is rule-based classification. Rule-based classification includes a large number of algorithms that fall under the categories of covering, greedy, rule induction, and associative classification. These approaches have shown promising results due to the simplicity of the models generated and the user’s ability to understand, and maintain them. Phishing is one of the emergent online threats in web security domains that necessitates anti-phishing models with rules so users can easily differentiate among website types. This paper critically analyses recent research studies on the use of predictive models with rules for phishing detection, and evaluates the applicability of these approaches on phishing. To accomplish our task, we experimentally evaluate four different rule-based classifiers that belong to greedy, associative classification and rule induction approaches on real phishing datasets and with respect to different evaluation measures. Moreover, we assess the classifiers derived and contrast them with known classic classification algorithms including Bayes Net and Simple Logistics. The aim of the comparison is to determine the pros and cons of predictive models with rules and reveal their actual performance when it comes to detecting phishing activities. The results clearly showed that eDRI, a recently greedy algorithm, not only generates useful models but these are also highly competitive with respect to predictive accuracy as well as runtime when they are employed as anti-phishing tools.

Deriving Correlated Sets of Website Features for Phishing Detection: A Computational Intelligence Approach

Classification is one of the major tasks in data mining which aims to build classifiers for decision making. One of the most recent online threats is phishing, which has caused significant losses to online shoppers, electronic businesses and financial institutions. A common way of phishing is impersonating online websites to deceive online users and steal their financial information. One way to guide the anti-phishing classification method is to preliminarily identify a minimal set of related features so the search space can be reduced. The aim of this paper is to compare different features assessment techniques in the website phishing context in order to determine the minimal set of features for detecting phishing activities. Experimental results on real phishing datasets consisting of 30 features has been conducted using three known features selection methods. New features cutoffs have been identified after statistical analysis utilising three data mining classification methods. We have been able to identify new clusters of features that when used together are able to detect phishing activities. Further, important correlations among common features have been derived.

An approach for profiling phishing activities

Phishing attacks continue unabated to plague Internet users and trick them into providing personal and confidential information to phishers. In this paper, an approach for email-born phishing detection based on profiling and clustering techniques is proposed. We formulate the profiling problem as a clustering problem using various features present in the phishing emails as feature vectors and generate profiles based on clustering predictions. These predictions are further utilized to generate complete profiles of the emails. We carried out extensive experimental analysis of the proposed approach in order to evaluate its effectiveness to various factors such as sensitivity to the type of data, number of data sizes and cluster sizes. We compared the performance of the proposed approach against the Modified Global Kmeans (MGKmeans) approach. The results show that the proposed approach is efficient as compared to the baseline approach.

Statistical Characterization of the Botnets C&C Traffic

Botnets are used for various purposes, most of them related to illegitimate activity, being also the sources of massive exploit activity as they recruit new vulnerable systems to expand their reach. Due to their volume, diverse capabilities and robustness, botnets pose a significant and growing threat to enterprise networks and to the Internet itself. Detecting botnets is a hard task and traditional network security systems are unable to successfully complete it. In fact, botnets are evolving and can be quite flexible: the protocols used for Command and Control (C&C) evolved from traditional IRC to others and the structure moved from centralized to distributed, using for example the Peer-to-Peer (P2P) communication paradigm. So, new generation botnet detection systems should be independent of the C&C protocol, botnet structure, infection model and resilient to the change of C&C server addresses. In addition, they should use all available information (from network probes, servers, routing elements, traffic statistics, identification of illicit applications), correlating it in the most useful way. Characterizing existing botnets is crucial to design and efficient detection methodology. Several approaches can be taken to study this phenomenon: analyze its source code, which can be a hard task mainly due to license restrictions; study of the botnet control, particularly the activity of its C&C server(s); study of the botnet behavior, namely its possible scanning activities, Denial of Service (DoS) attacks, spamming or phishing activities, among other possibilities. This work will mainly use the last two approaches to characterize (i) the traffic generated by each bot when communicating with the C&C server(s) and (ii) identify and analyze the main patterns of the botnet generated traffic.

Using one-time passwords to prevent password phishing attacks

Phishing is now a serious threat to the security of Internet users' confidential information. Basically, an attacker (phisher) tricks people into divulging sensitive information by sending fake messages to a large number of users at random. Unsuspecting users who follow the instruction in the messages are directed to well-built spoofed web pages and asked to provide sensitive information, which the phisher then steals. Based on our observations, more than 70% of phishing activities are designed to steal users' account names and passwords. With such information, an attacker can retrieve more valuable information from the compromised accounts. Statistics published by the anti-phishing working group (APWG) show that, at the end of Q2 in 2008, the number of malicious web pages designed to steal users' passwords had increased by 258% over the same period in 2007. Therefore, protecting users from phishing attacks is extremely important. A naïve way to prevent the theft of passwords is to avoid using passwords. This raises the following question: Is it possible to authenticate a user without a preset password? In this paper, we propose a practical authentication service that eliminates the need for preset user passwords during the authentication process. By leveraging existing communication infrastructures on the Internet, i.e., the instant messaging service, it is only necessary to deploy the proposed scheme on the server side. We also show that the proposed solution can be seamlessly integrated with the OpenID service so that websites supporting OpenID benefit directly from the proposed solution. The proposed solution can be deployed incrementally, and it does not require client-side scripts, plug-ins, nor external devices. We believe that the number of phishing attacks could be reduced substantially if users were not required to provide their own passwords when accessing web pages.