Phishing Attack Detection Research Articles

A Comparative Analysis of Feature Eliminator Methods to Improve Machine Learning Phishing Detection

This Machine-learning-based phishing detection employs statistical models and algorithms to assess and recognise phishing attacks. These algorithms can learn patterns and features that distinguish between phishing and non-phishing attacks once they are trained on vast amounts of data from both types of cases. Phishing detection systems can quickly evaluate considerable data, identify possible phishing attempts, and warn users of potential dangers. Machine-learning-based phishing detection systems have the potential to continuously improve their accuracy over time through ongoing feature refinement, iterative model evaluation, and algorithm optimization. In contrast to conventional techniques, these systems offer a more effective and efficient approach to identifying and mitigating phishing attacks. This research critically analyzes existing literature on phishing detection, aiming to identify all proposed features and determine the critical ones necessary for accurate and fast phishing attack detection. By eliminating unnecessary overhead, this research enhances our understanding of feature eliminator methods and their role in improving machine learning-based phishing detection. The findings would contribute to the development of more robust cybersecurity measures to combat phishing attacks, as well as advance the field's knowledge and application of machine learning in detecting and mitigating such threats. The study highlights the importance of feature selection and optimization in achieving accurate and efficient phishing detection, ultimately strengthening the overall security posture of organizations and individuals against phishing attacks.

A Priori Algorithm Based Network Security Situational Awareness Multi-Source Data Correlation Analysis Method

In the context of the information age, the Internet has developed rapidly, but the accompanying network security threats have also become an issue that cannot be ignored. In order to effectively respond to these threats and improve the data processing capabilities of network security situational awareness, the study focuses on the challenges of multi-source data processing and proposes a multi-source data association analysis method based on the A priori algorithm. This method aims to deeply explore the implicit relationships between data and provide stronger support for network attack detection. In addition, the study also designed a multi-level evaluation method based on coefficient of variation indicators, aiming to provide a more objective and comprehensive evaluation of the detection results. After a series of experimental verification, the proposed correlation analysis method has achieved significant results in detecting phishing attacks and DOS attacks, with detection rates of 90.3% and 93.8%, respectively. At the same time, the multi-level evaluation method has also been experimentally proven to provide more reasonable and accurate results for data evaluation. The methods and technologies proposed in the study can not only improve the multi-source data processing ability of network security situational awareness, but also provide valuable references for future network security research and practice.

Phishing like the first step to gaining access

Phishing as a term that means the technique of sending phishing messages will be re-searched based on findings in public access and using the listed links. The process of a phish-ing attack will be analyzed, and then we will pay attention to the technical vectors of how us-ers become victims of the attack. Finally, existing research on phishing attacks and related prevention approaches will be reviewed. Mitigating phishing attacks is an important research topic worth exploring. Although a lot of research has been done, this threat still exists in the real world, and its prevalence is constantly increasing. According to research results, detecting phishing attacks is a difficult problem. There are two main strategies used to mitigate phishing attacks; or improving the performance of phishing detection technology or improving people's awareness of these at-tacks. Developing human expertise is a key way to defeat phishing attacks, as phishing attacks exploit human weaknesses rather than network weaknesses. Also, humans are always the weakest link in social engineering attacks. Compared to phishing website detection, phishing email detection may require user in-volvement to achieve better detection results. Because the success of a phishing email de-pends on its context. Specifically, when the premise of the phishing email is consistent with the user's work context (or current situation). Most anti-phishing solutions are implemented to mitigate general phishing attacks, but they ignore some specific situations, such as advanced phishing attacks. To prevent advanced phishing attacks, phishing websites are difficult to detect if a victim is attacked using stolen DNS data because the URL content and website content are the same as legitimate websites. Most content-based approaches may not work because the content of the accessed URL is an important factor in the decision. To prevent subdomain hijacking attacks, it is difficult to detect a phishing website if the phishers have hosted the website on a subdomain taken from a legitimate website. Regardless of the web content, URL, and SSL certificate information, they will all be the same as the le-gitimate website. Moreover, the approach to enumeration of subdomains needs improvement, as most current tools are based on rough enumeration, existing dictionaries may not cover all instances of subdomains, as some subdomains may be meaningless.

Develop a Hybrid Classification using an Ensemble Model for Phishing Website Detection

Solutions to threats posed by technical and social vulnerabilities must be found to secure the web interface. Social engineering attacks frequently use phishing as one of their vectors. The importance is promptly detecting phishing attacks has increased. The classifier model was constructed using publicly accessible data from trustworthy and phishing websites. A variety of methods were used to extract relevant features to build the model. Before a user experiences any harm, Machine Learning algorithms can reliably identify phishing attacks. To identify phishing attacks on the website, this study presents a novel ensemble model. In this paper, the Artificial Neural Network (ANN) and the Random Forest Classifier (RFC) are used in an ensemble method along with the Support Vector Machine (SVM). Compared to previous studies, this ensemble method more accurately and efficiently detects website phishing attacks. According to experimental findings, the proposed system detects phishing attacks 97.3% of the time.

HTTP header based phishing attack detection using machine learning

AbstractIn the past, many techniques like blacklisting/whitelisting, third‐party, search engine, visual similarity, heuristic, URL features, and website content were used for anti‐phishing. Search engine‐based, third‐party assisted tools and blacklist/whitelist fail to identify new phishing attacks resulting in high FPR. Heuristic and visual similarity approaches are slow, whereas URL and web content‐based techniques do not mimic the dynamic content of current websites and hence cannot stop zero‐day attacks. A study was conducted to understand the critical features used in the past for anti‐phishing, and we found 16 HTTP header features that were novel. In this paper, we have developed a real‐time, highly scalable, feature‐rich anti‐phishing detection technique based on ML that extracts the HTTP headers (predominantly security headers) from web pages to identify them as legitimate or phished. It is observed that phishing sites are short‐lived and are created to achieve a specific objective, like stealing the credential of a user. Once the goal is met, the sites are pulled down immediately. Hence these sites do not take pain to use the security features of web technology and only focus on making the site as similar as possible to the original website. Test results based on our novel features show high accuracy of 97.8% with an average response time of 1.57 s. We have created multiple datasets for different scenarios, like a dataset for website creation through phishing tools and a new dataset for testing unseen phishing attacks. The results thus obtained show detection accuracy of 99% and 95%, respectively.

A Hybrid Approach for Alluring Ads Phishing Attack Detection Using Machine Learning.

Phishing attacks are evolving with more sophisticated techniques, posing significant threats. Considering the potential of machine-learning-based approaches, our research presents a similar modern approach for web phishing detection by applying powerful machine learning algorithms. An efficient layered classification model is proposed to detect websites based on their URL structure, text, and image features. Previously, similar studies have used machine learning techniques for URL features with a limited dataset. In our research, we have used a large dataset of 20,000 website URLs, and 22 salient features from each URL are extracted to prepare a comprehensive dataset. Along with this, another dataset containing website text is also prepared for NLP-based text evaluation. It is seen that many phishing websites contain text as images, and to handle this, the text from images is extracted to classify it as spam or legitimate. The experimental evaluation demonstrated efficient and accurate phishing detection. Our layered classification model uses support vector machine (SVM), XGBoost, random forest, multilayer perceptron, linear regression, decision tree, naïve Bayes, and SVC algorithms. The performance evaluation revealed that the XGBoost algorithm outperformed other applied models with maximum accuracy and precision of 94% in the training phase and 91% in the testing phase. Multilayer perceptron also worked well with an accuracy of 91% in the testing phase. The accuracy results for random forest and decision tree were 91% and 90%, respectively. Logistic regression and SVM algorithms were used in the text-based classification, and the accuracy was found to be 87% and 88%, respectively. With these precision values, the models classified phishing and legitimate websites very well, based on URL, text, and image features. This research contributes to early detection of sophisticated phishing attacks, enhancing internet user security.

Deep Learning Multi-Agent Model for Phishing Cyber-attack Detection

Phishing attacks have become one of the most prominent cyber threats in recent times, which poses a significant risk to the security of organizations and individuals. Therefore, detecting such Cyber attacks has become crucial to ensure a secure digital environment. In this regard, deep learning techniques have shown promising results for the detection of phishing attacks due to their ability to learn and extract features from raw data. In this study, we propose a deep learning-based approach to detecting phishing attacks by using a combination of convolutional neural networks (CNN) and long short-term memory (LSTM) networks. Our proposed model extracts features from the URL and email content to detect phishing attempts. We evaluate the proposed approach on a real-world dataset and achieve an accuracy of over 95%. The results indicate that the proposed approach can effectively detect phishing attacks and can be utilized in real-world applications to ensure a secure digital environment.

AI-based Spam Detection Techniques for Online Social Networks: Challenges and Opportunities

In recent years, online social networks (OSNs) have become a huge used platform for sharing activities, opinions, and advertisements. Spam content is considered one of the biggest threats in social networks. Spammers exploit OSNs for falsifying content as part of phishing, such as sharing forged advertisements, selling forged products, or sharing sexual words. Therefore, machine learning (ML) and deep learning (DL) techniques are the best methods for detecting phishing attacks and minimize their risk. This paper provides an overview of prior studies of OSNs spam detection modeling based on ML and DL techniques. The research papers are classified into three categories: the features used for prediction, the dataset size corresponding language used, real-time based applications, and machine learning or deep learning techniques. Challenges and opportunities in phishing attacks prediction using ML and DL techniques are also concluded in our study.

A high-accuracy phishing website detection method based on machine learning

The rapid development of e-commerce, e-banking, and social networks has made phishing attack detection one of the most critical technologies in all cyber security systems. To improve the efficiency of anti-phishing techniques, we present an improved predictive model based on machine learning. The proposed method uses six different algorithms; Logistic Regression, K-Nearest Neighbors, Naive Bayes, Random Forest, Support Vector Machine, and Extreme Gradient Boosting (XGBoost). The experiments are based on a public dataset of 58,000 legitimate websites and 30,647 phishing ones, including 112 attributes for each sample. Our evaluations in the feature selection process show that after balancing the dataset and dropping constant features, a noticeable improvement can be achieved. We conducted our evaluation found on eight major unique scenarios. The experimental results of our phishing websites detection (PWD) method indicate remarkable performances in which each algorithm reached an accuracy of more than 93%, and the XGBoost classifier outperforms others with 99.2% overall accuracy, 99.1% precision, 99.4% recall, and 99.1% specificity. In addition, the study achieved optimal run-time of about 1500 ms for the XGBoost algorithm without dimension reduction while using Principal Component Analysis (PCA) reduces it down to just 869 ms. As a result, the proposed approach would be practical in both offline and real-time applications.

Binary Hunter-Prey Optimization with Machine Learning-Based Cybersecurity Solution on Internet of Things Environment.

Internet of Things (IoT) enables day-to-day objects to connect with the Internet and transmit and receive data for meaningful purposes. Recently, IoT has resulted in many revolutions in all sectors. Nonetheless, security risks to IoT networks and devices are persistently disruptive due to the growth of Internet technology. Phishing becomes a common threat to Internet users, where the attacker aims to fraudulently extract confidential data of the system or user by using websites, fictitious emails, etc. Due to the dramatic growth in IoT devices, hackers target IoT gadgets, including smart cars, security cameras, and so on, and perpetrate phishing attacks to gain control over the vulnerable device for malicious purposes. These scams have been increasing and advancing over the last few years. To resolve these problems, this paper presents a binary Hunter-prey optimization with a machine learning-based phishing attack detection (BHPO-MLPAD) method in the IoT environment. The BHPO-MLPAD technique can find phishing attacks through feature selection and classification. In the presented BHPO-MLPAD technique, the BHPO algorithm primarily chooses an optimal subset of features. The cascaded forward neural network (CFNN) model is employed for phishing attack detection. To adjust the parameter values of the CFNN model, the variable step fruit fly optimization (VFFO) algorithm is utilized. The performance assessment of the BHPO-MLPAD method takes place on the benchmark dataset. The results inferred the betterment of the BHPO-MLPAD technique over compared approaches in different evaluation measures.

Life-long phishing attack detection using continual learning

Phishing is an identity theft that employs social engineering methods to get confidential data from unwary users. A phisher frequently attempts to trick the victim into clicking a URL that leads to a malicious website. Many phishing attack victims lose their credentials and digital assets daily. This study demonstrates how the performance of traditional machine learning (ML)-based phishing detection models deteriorates over time. This failure is due to drastic changes in feature distributions caused by new phishing techniques and technological evolution over time. This paper explores continual learning (CL) techniques for sustained phishing detection performance over time. To demonstrate this behavior, we collect phishing and benign samples for three consecutive years from 2018 to 2020 and divide them into six datasets to evaluate traditional ML and proposed CL algorithms. We train a vanilla neural network (VNN) model in the CL fashion using deep feature embedding of HTML contents. We compare the proposed CL algorithms with the VNN model trained from scratch and with transfer learning (TL). We show that CL algorithms maintain accuracy over time with a tolerable deterioration of 2.45%. In contrast, VNN and TL-based models’ performance deteriorates by over 20.65% and 8%, respectively.

Detection of Phishing Threats Using Neural Networks

Today, the Internet is an effective channel for social interaction worldwide, but it also opens up great opportunities for cyberattacks. Recently, the number of botnets and phishing cyberattacks has increased dramatically. Phishing is a cyber attack carried out using a fake website designed to steal sensitive information. Detecting such attacks using machine learning algorithms and neural systems is an efficient and fast method. This paper discusses the types of Internet threats and neural network algorithms used to counter phishing attacks. The main goal of this paper is to build neural network models capable of effectively detecting phishing attacks. The methods of research are data analysis, data preprocesses and neural networks. In the first step, the Kaggle dataset containing data from 5000 legitimate and 5000 malicious web pages was gathered. The features of the dataset were analyzed and normalized. Then the Deep neural network, Convolutional neural network and Long short-term memory network were applied for threat classification. The Deep neural network and Long short-term memory network showed the best results of accuracy up to 0.96 and 0.99, while the Convolutional neural network reached only 0.75. Generally, the Deep neural network and Long short-term memory achieved the best results among the neural network methods.

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Phishing poses a significant threat to the financial and privacy security of internet users and often serves as the starting point for cyberattacks. Many machine-learning-based methods for detecting phishing websites rely on URL analysis, offering simplicity and efficiency. However, these approaches are not always effective due to the following reasons: (1) highly concealed phishing websites may employ tactics such as masquerading URL addresses to deceive machine learning models, and (2) phishing attackers frequently change their phishing website URLs to evade detection. In this study, we propose a robust, multi-view Transformer model with an expert-mixture mechanism for accurate phishing website detection utilizing website URLs, attributes, content, and behavioral information. Specifically, we first adapted a pretrained language model for URL representation learning by applying adversarial post-training learning in order to extract semantic information from URLs. Next, we captured the attribute, content, and behavioral features of the websites and encoded them as vectors, which, alongside the URL embeddings, constitute the website’s multi-view information. Subsequently, we introduced a mixture-of-experts mechanism into the Transformer network to learn knowledge from different views and adaptively fuse information from various views. The proposed method outperforms state-of-the-art approaches in evaluations of real phishing websites, demonstrating greater performance with less label dependency. Furthermore, we show the superior robustness and enhanced adaptability of the proposed method to unseen samples and data drift in more challenging experimental settings.

Machine Learning Approach for Phishing Attack Detection

Phishing is the easiest method for gathering sensitive information from unwary people. Phishers seek to get private data including passwords, login information, and bank account details. Cyber security experts are actively seeking for trustworthy and effective ways to identify phishing websites. In order to distinguish between legal and phishing URLs, we used machine learning (ML) technology. In this research work using ML technology extraction and analysis of both types of URLs was performed. Extreme Gradient Boosting (XGBoost), Decision Tree (DT), Logistic Regression (LR), Random Forest (RF), and Support Vector Machine (SVM) were used to identify phishing websites. The goal was to identify phishing URLs and determine the most effective ML technique by comparing the accuracy rates of each algorithm. In this, proposed methodology two datasets were used. The accuracy of models was calculated on Phishtank and UCI dataset using kfold, feature selection and hyperparameter tuning method. Performance measures precision, recall and F1-score and Receiver Operating Characteristics (ROC) curve were calculated. RF provided an accuracy of 98.80% and 97.87% on the Phishtank dataset and UCI respectively. Highest precision, recall, F1-score value was 99% each and AUC-ROC value was 99.89% with Phishtank dataset. Validation with other researchers showed better results with proposed methodology. Therefore this methodology can be of help to identify phishing websites.

Detecting Cloud Based Phishing Attacks Using Stacking Ensemble Machine Learning Technique

Abstract: Cloud computing enables users to access computing services over the Internet, but this also presents a security risk due to the anonymous nature of the Internet. Social engineering attacks are one of the most common security breaches in cloud computing, where attackers trick cloud users to reveal sensitive information. Detecting phishing attacks in cloud computing is challenging, and various solutions have been proposed, including rule-based and anomaly-based detection methods. Machine learning techniques have proven to be effective in detecting and classifying phishing attacks, particularly for distinguishing between legitimate and phishing websites. This paper proposes an ensemble approach utilizing four different machine learning classifiers to detect phishing websites. The study analyzes various features, such as address bar-based, domain-based, and HTML & JavaScript-based features, and the findings reveal that the proposed ensemble approach outperforms the base classifiers, achieving the highest accuracy of 98.8%.

Phishing URLs Detection Using Sequential and Parallel ML Techniques: Comparative Analysis

In today's digitalized era, the world wide web services are a vital aspect of each individual's daily life and are accessible to the users via uniform resource locators (URLs). Cybercriminals constantly adapt to new security technologies and use URLs to exploit vulnerabilities for illicit benefits such as stealing users' personal and sensitive data, which can lead to financial loss, discredit, ransomware, or the spread of malicious infections and catastrophic cyber-attacks such as phishing attacks. Phishing attacks are being recognized as the leading source of data breaches and the most prevalent deceitful scam of cyber-attacks. Artificial intelligence (AI)-based techniques such as machine learning (ML) and deep learning (DL) have proven to be infallible in detecting phishing attacks. Nevertheless, sequential ML can be time intensive and not highly efficient in real-time detection. It can also be incapable of handling vast amounts of data. However, utilizing parallel computing techniques in ML can help build precise, robust, and effective models for detecting phishing attacks with less computation time. Therefore, in this proposed study, we utilized various multiprocessing and multithreading techniques in Python to train ML and DL models. The dataset used comprised 54 K records for training and 12 K for testing. Five experiments were carried out, the first one based on sequential execution followed by the next four based on parallel execution techniques (threading using Python parallel backend, threading using Python parallel backend and number of jobs, threading manually, and multiprocessing using Python parallel backend). Four models, namely, random forest (RF), naïve bayes (NB), convolutional neural network (CNN), and long short-term memory (LSTM) were deployed to carry out the experiments. Overall, the experiments yielded excellent results and speedup. Lastly, to consolidate, a comprehensive comparative analysis was performed.

Web Phishing Detection Using Web Crawling, Cloud Infrastructure and Deep Learning Framework

The pandemic of COVID-19 obliges citizens to follow the “work from home “scheme. The Internet is also a powerful channel for social connections. The huge dependency of people on digital media opens doors to fraud. Phishing is a form of cybercrime that is used to rob users of passwords from online banking, e-commerce, online schools, digital markets, and others. Phishers create bogus websites like the original and deliver users spam mails. When an online user visits fake web pages via spam, phishers steal their credentials. As a result, it is important to identify these forms of fraudulent websites until they do any harm to victims. Inspired by the ever-changing existence of phishing websites. This paper reviews the work on Phishing attack detection and aims to examine techniques that mainly detect and help in preventing phishing attacks rather than mitigating them. Here we offered a general overview of the most effective phishing attack detection strategies focused on deep learning.

Phishing URL Detection using LSTM Based Ensemble Learning Approaches

Increasing incidents of phishing attacks tempt a significant challenge for cybersecurity personals. Phishing is a deceitful venture with an intention to steal confidential information of an organization or an individual. Many works have been performed to build anti-phishing solutions over the years, but attackers are coming with new manoeuvres from time to time. Many of the existing techniques are experimented based on limited set of URLs and dependent on other software to collect domain related information of the URLs. In this paper, with an aim to build a more accurate and effective phishing attack detection system, we used the concept of ensemble learning using Long Short-Term Memory (LSTM) models. We proposed ensemble of LSTM models using bagging approach and stacking approach. For performing classification using LSTM method, no separate feature extraction is done. Ensemble models are built integrating the predictions of multiple LSTM models. Performances of proposed ensemble LSTM methods are compared with five different machine learning classification methods. To implement these machine learning algorithms, different URL based lexical features are extracted. Mutual Information based feature selection algorithm is used to select more relevant features to perform classifications. Both the bagging and the stacking approaches of ensemble learning using LSTM models outperform other machine learning techniques. The results are compared with other anti-phishing solutions implemented using deep learning methods. Our approaches have proved to be the more accurate one with a low false positive rate of less than 0.15% performed comparatively on a larger dataset.

Detection of Phishing in Internet-of-Things Using Hybrid Deep Belief Network

Increase in the use of internet of things owned devices is one of the reasons for increased network traffic. While connecting the smart devices with publicly available network many kinds of phishing attacks are able to enter into the mobile devices and corrupt the existing system. The Phishing is the slow and resilient attack stacking techniques probe the users. The proposed model is focused on detecting phishing attacks in internet of things enabled devices through a robust algorithm called Novel Watch and Trap Algorithm (NWAT). Though Predictive mapping, Predictive Validation and Predictive analysis mechanism is developed. For the test purpose Canadian Institute of cyber security (CIC) dataset is used for creating a robust prediction model. This attack generates a resilience corruption works that slowly gathers the credential information from the mobiles. The proposed Predictive analysis model (PAM) enabled NWAT algorithm is used to predict the phishing probes in the form of suspicious process happening in the IoT networks. The prediction system considers the peer-to-peer communication window open for the established communication, the suspicious process and its pattern is identified by the new approach. The proposed model is validated by finding the prediction accuracy, Precision, recalls F1score, error rate, Mathew’s Correlation Coefficient (MCC) and Balanced Detection Rate (BDR). The presented approach is comparatively analyzed with the state-of-the-art approach of existing system related to various types of Phishing probes.

A hybridization of butterfly optimization algorithm and harmony search for fuzzy modelling in phishing attack detection

A hybridization of butterfly optimization algorithm and harmony search for fuzzy modelling in phishing attack detection