Phishing Research Articles

Novel Optimization-Driven Feature Selection Approach for Enhancing Phishing Website Detection Accuracy

Phishing attacks continue to pose significant threats to cybersecurity, prompting the need for robust detection mechanisms. This study introduces an optimization-driven feature selection approach aimed at enhancing the accuracy of phishing website detection. By systematically selecting and prioritizing relevant features, guided by advanced optimization techniques, the proposed approach outperforms traditional baseline methods across various evaluation metrics. Experimental results demonstrate notable improvements in detection accuracy and robustness compared to conventional techniques. The optimization-driven approach offers scalability, adaptability, and efficiency in navigating the feature space, making it suitable for diverse datasets and scenarios. This study contributes to the advancement of phishing detection systems by providing a systematic and effective approach for identifying relevant features and minimizing false alarms and false negatives. Future research should explore the integration of machine learning models and conduct real-world validation studies to further validate the effectiveness and generalizability of the proposed approach.

Machine Learning Approaches For Phishing Detection: A Comparative Analysis

In this study, the effectiveness of four machine learning models in detecting phishing websites is evaluated. Utilizing a diverse dataset, the analysis reveals that Random Forest emerges as the top performer, achieving a test accuracy of 91.49%. Notably, Random Forest exhibits robustness in distinguishing between legitimate websites and malicious ones. While Decision Tree, K-Nearest Neighbors, and Naive Bayes also demonstrate promise, they encounter difficulties in accurately classifying phishing URLs, especially within certain categories. The findings underscore the pivotal role of machine learning in cybersecurity defence against phishing attacks. The study suggests avenues for future research, such as enhanced feature engineering and exploration of advanced ensemble techniques and deep learning approaches for improved phishing detection. This research contributes to the ongoing endeavours to develop more resilient anti-phishing tools and bolster digital security against evolving cyber threats. Key Words: Phishing, Machine Learning, Cybersecurity, Random Forest, Decision Tree, K-Nearest Neighbors, Naive Bayes, Website Detection, Feature Engineering, Ensemble Techniques, Model Comparison, Fine-Tuning.

Graph-based phishing detection: URLGBM model driven by machine learning

Phishing attacks are a form of social engineering that involves the transmission of deceptive communications imitating a trustworthy source to deceive users into revealing confidential information. Antiphishing systems have made significant strides in recent years, allowing internet users to secure confidential and private information against such attacks. In this study, we propose a URL graph representation based on a random walk algorithm, specifically PageRank, for weighting URL tokens. To create the graph, an imaginary walker visits the URL tokens one at a time and assigns a value to each token based on the probability of encountering the target URL during the walk. We studied different random walk (rw) variations and their effects on the URL string. The BM25 algorithm was employed to produce a sparse matrix for the classification task from the token scores obtained. Experiments conducted with logistic regression revealed that the proposed model achieved an accuracy of 98.98%, a false alarm rate of 1.72%, and a missing alarm rate of 0.302%. The model also attained a 97.17% accuracy on a benchmark dataset.

Phish Catcher: Client-Side Defense against Web-Spoofing Attacks Using Machine Learning

Cybersecurity faces a significant challenge in safeguarding users' confidential information, such as passwords and PIN codes, from phishing attacks. These attacks, which employ various deceptive tactics like fake login pages, phishing emails, and click-jacking, aim to trick users into divulging sensitive data. Traditional security strategies often encounter issues of latency and accuracy in detecting these fraudulent activities. To address this challenge, we propose a client-side defense mechanism leveraging machine learning techniques to detect spoofed web pages and protect users from phishing attacks. In this work, we introduce Phish Catcher, a Google Chrome extension developed as a proof of concept for our machine learning-based approach. Phish Catcher utilizes a random forest classifier trained on four types of web features to classify URLs as suspicious or trustworthy. To evaluate the effectiveness of our extension, we conducted experiments on real web applications, testing 400 classified phishing URLs and 400 legitimate URLs. The results demonstrate a remarkable accuracy and precision of 98.5% for detecting spoofed web pages. Furthermore, we assessed the latency of Phish Catcher by measuring its response time over forty phished URLs. The average recorded response time was just 62.5 milliseconds, indicating minimal impact on user experience while providing robust protection against phishing attacks. Overall, our approach offers a highly accurate and efficient solution for detecting phishing attempts, thereby enhancing user security and mitigating the risks associated with online fraud.

A Comprehensive Review of Phishing Attacks Techniques, Types and Solutions

Phishing attacks continue to pose significant threats to individuals, businesses, and organizations worldwide. This paper presents an in-depth analysis of phishing attacks, focusing on their techniques, and highlighting their methods, consequences, and strategies for prevention. Through an extensive analysis of existing literature, this review aims to provide insights into the evolving nature of phishing attacks and effective strategies for detection, prevention, and mitigation. Scammers employ phishing, a con game, to get personal information from unwary users. False emails can have a startlingly authentic appearance, and even websites requesting personal information from consumers may seem genuine. Phishing is like lake fishing; however, instead of aiming to catch fish, phishers strive to obtain personal data. This article provides readers with a quick overview of phishing, its assaults, and precautions they may take to protect their private information. Phishing is an ever-expanding cyber threat that costs internet users billions of dollars in damages annually. It is an illegal operation that gathers private information from Internet users by using social engineering and other technologies.

Impact Of Web (URL) Phishing and Its Detection

Abstract: Web phishing is a persuasive and evolving cyber threat that poses significant risks to individuals, businesses, and organizations in the modern digital age. This paper aims to provide an overview of web phishing, focusing on its methods, detection techniques, and prevention. Phishing attacks occur when malicious actors use deceptive practices to trick people into divulging sensitive or classified information such as passwords, credit card details, or personal data. These attacks primarily manifest through emails, websites, or social engineering tactics. Phishing emails often impersonate trusted entities and lure recipients into clicking on malicious links or downloading harmful attachments. Web phishing involves using fraudulent websites that mimic legitimate ones to steal user information or deliver malware. Detecting web phishing attacks is an ongoing challenge due to the sophistication of attackers. Several detection techniques have been developed, including heuristic analysis, machine learning algorithms, and real-time URL analysis. These methods analyze various attributes of websites and emails to identify suspicious patterns or behaviors. Detecting web phishing is equally essential. Effective prevention strategies include user education and awareness programs, using two-factor authentication, regular software updates, and deploying advanced email filtering and anti-phishing tools. User training is crucial in helping individuals recognize phishing attempts and avoid falling victim to them.

Phishing Webpage Detection using Feature Selection Methods

Phishing attacks are rapidly taking place around the globe. This makes it vital to have efficient phishing detection methods in place. All the datasets that are available are voluminous generally with a vast number of features. Furthermore, many of the features present are redundant or irrelevant and don’t substantially help in determining the final outcome. Therefore, it is necessary to identify those features and eliminate them to help reduce resources & time.This paper proposes two phishing detection techniques wherein one method incorporates ensemble feature reduction method and the other incorporates a feature reduction method based on average weight which help in eliminating irrelevant features and making a compact subset of the features to identify phishing attacks. These two methods are based on correlation, chi square, gain ratio, and information gain. The system uses Random Forest classifier which outperforms the rest of the classifiers. The comparison between both the methods is provided and the best method is determined taking factors like accuracy and computational time into consideration. The Phishing Webpage dataset is taken from Mendeley data.

A Novel Model Based on Ensemble Learning for Phishing Attack

With the increase in the speed of the internet environment and the development of the infrastructures used, people have started to perform most of their work online. As much as this makes life easier, it also increases the possibility of being attacked by malicious people. Attackers can activate a phishing attack that aims to steal information from victims by creating copied, fake websites. While this attack is very old and somewhat simple, it can still be effective due to low IT literacy. People can enter their information on these fake websites out of spontaneity or ignorance or good intentions and be exposed to Phishing attacks. The compromise of a user's account information also puts at risk the security of the organization or institution to which it is connected. In this study, we propose a new machine learning-based ensemble model with feature selection methods to detect phishing attacks. Also, an ablation study is presented to measure the effect of different feature selection methods. The proposed model which we named as NaiveStackingSymmetric (NSS) is analyzed using the widely used accuracy (ACC), the area under curve (AUC), and F-score metrics as well as the polygon area metric (PAM), and it is shown that it outperforms other studies in the literature using the same dataset.

Phishing URL detection generalisation using Unsupervised Domain Adaptation

Phishing attacks are a prevailing problem in cybersecurity. In many data breaches, the initial entry can be traced back to phishing. URL-based phishing detection is one of the many ways of phishing attempt detection where solely the properties of the URLs are used to decide whether a given URL is phishing or not. While there are multiple existing works that use machine learning and deep learning to detect phishing URLs, in this paper, we show that such methods lack generalisation (i.e., they work effectively only when the test sets are split from the same training dataset). This is a significant issue since the vast majority of phishing attempts are short-lived and use freshly created domain names. Also, many network vantage points and middleboxes record URLs in slightly different formats and as such, URL data collected at various companies may be different. To address this, we propose an Unsupervised Domain Adaptation-based framework to increase the model transferability between datasets. We evaluate our approach using three datasets and show that the increase in cross-dataset F1 score performance is 0.06 on average and in some cases approximately as high as 0.2.

PhishingRTDS: A real-time detection system for phishing attacks using a Deep Learning model

In recent years, phishing attacks have become more intelligent and more challenging to detect using typical phishing methods. Moreover, attackers have leveraged some web development techniques to increase the website's legitimacy in victims' eyes, such as using JFrame to design a window that looks like a browser inside the webpage. In this paper, we design a system that detects three types of phishing attacks: Tiny Uniform Resource Locators (TinyURLs), Browsers in the Browser (BiTB), and regular phishing attacks. In this system, we aim to protect victims from mistakenly downloading malicious software into their systems. We split our system into three parts: Deep Learning model (DL), browser extension, and docker container. First, we design a DL model using bidirectional long short-term memory (BiLSTM) and an attention mechanism to classify the URL as phishing or benign. Our model shows 99% in its precision, recall, and F1 score. Second, we design a browser extension to extract the original URL from the suspect webpage and then send it to the docker container. Then, the docker container opens the webpage and extracts all URLs from its HyperText Markup Language (HTML) and JavaScript. Then, each URL passes to a DL model for classification, resulting in a list of labels for each webpage. Therefore, we use three decision strategies: Single Phishing Strategy (SPhS), Mean Sum Strategy (MSS), and Weighted Average Strategy (WeAS) to decide whether the webpage is phishing or benign. Our findings indicate that the best results among the three strategies were WeAS.

Enhancing cybersecurity: A review and comparative analysis of convolutional neural network approaches for detecting URL-based phishing attacks

Phishing attempts to mimic the official websites of businesses, including banks, e-commerce, government offices, and financial institutions. Phishing websites aim to collect and retrieve sensitive data from users, including passwords, credit card numbers, email addresses, personal information, and so on. The growing frequency of phishing attacks has prompted the development of numerous anti-phishing technologies. Because machine learning (ML) techniques perform better in categorization problems, they are used extensively. But the most crucial features are not extracted by the algorithms in use today, which could result in a false categorization. In addition, the complex algorithms contribute to the long reaction time. To solve these issues, this study suggests using a Bidirectional Long Short-Term Memory-based Gated Highway Attention Block Convolutional Neural Network (BiLSTM-GHA-CNN) to detect phishing URLs.

Data correlation matrix-based spam URL detection using machine learning algorithms

In recent years, the widespread availability of internet access has brought both advantages and disadvantages. Users now enjoy numerous benefits, including unlimited access to vast amounts of information and seamless communication with others. However, this accessibility also exposes users to various threats, including malicious software and deceptive practices, leading to victimization of many individuals. Common issues encountered include spam emails, fake websites, and phishing attempts. Given the essential nature of internet usage in contemporary society, the development of systems to protect users from such malicious activities has become imperative. Accordingly, this study utilized eight prominent machine learning algorithms to identify spam URLs using a large dataset. Since the dataset only contained URL information and spam classification, additional feature extractions such as URL length and the number of digits were necessary. The inclusion of such features enhances decision-making processes within the framework of machine learning, resulting in more efficient detection. As the effectiveness of feature extraction significantly impacts the results of the methods, the study initially conducted feature extraction and trained models based on the weight of features. This paper proposes a data correlated matrix approach for spam URL detection using machine learning algorithms. The distinctive aspect of this study lies in the feature extraction process applied to the dataset, aimed at discerning the most impactful features, and subsequently training models while considering the weighting of these features. The entire dataset was used without any reduction in data. Experimental findings indicate that tree-based machine learning algorithms yield superior results. Among all applied methods, the Random Forest approach achieved the highest success rate, with a detection rate of 96.33% for the non-spam class. Additionally, a combined and weighted calculation method yielded an accuracy of 94.16% for both spam and non-spam data.

Phishing URL Detection using Machine Learning

Abstract: Phishing attacks pose a significant threat in cyberspace, Cybercrimes such as Phishing means accessing personal data and violating security through the Internet and its main aim is to steal the information from the users using different techniques in that the primary one is Phishing which demands effective detection mechanisms. This study evaluates the performance of Gradient Boosting Classifier, Random Forest, and Decision Tree machine learning models in conjunction with feature selection techniques namely SelectKBest and Chi-Square. Initially, a comprehensive feature set of 30 attributes achieved a baseline accuracy of 97.4%. Through SelectKBest and Chi-Square feature selection methods, 13 key features were identified, leading to a slightly decreased accuracy of 95.6% upon model retraining. This research highlights the importance of feature selection in enhancing phishing detection accuracy while maintaining model interpretability. Technologies such as NumPy, Pandas, Matplotlib, Scikit-learn, and Flask drive. The project, emphasising the exploration of ML models, EDA (Exploratory Data Analysis) on phishing data, and understanding feature importance. The Machine Learning Models like Gradient Boosting Classifier, Random Forest and Decision tree are used to detect whether the given URL is Malicious URL or Legitimate URL using Comprehensive Feature set and Key Feature set. This Models and Feature sets are compared based on the Performance Metrics namely Accuracy, Precision, Recall and F1- score. This study contributes to advancing cyber defence mechanism through the fusion of sophisticated Machine Learning algorithms and meticulous Feature Selection methodologies.

Learning to Traverse Cryptocurrency Transaction Graphs Based on Transformer Network for Phishing Scam Detection

Cryptocurrencies have experienced a surge in popularity, paralleled by an increase in phishing scams exploiting their transactional networks. Therefore, detecting anomalous transactions in the complex structure of cryptocurrency transaction data and the imbalance between legitimate and fraudulent data is considered a very important task. To this end, we introduce a model specifically designed for scam detection within the Ethereum network, focusing on its capability to process long and complex transaction graphs. Our method, Deep Graph traversal based on Transformer for Scam Detection (DGTSD), employs the DeepWalk algorithm to traverse extensive graph structures and a Transformer-based classifier to analyze intricate node relationships within these graphs. The necessity for such an approach arises from the inherent complexity and vastness of Ethereum transaction data, which traditional techniques struggle to process effectively. DGTSD applies subgraph sampling to manage this complexity, targeting significant portions of the network for detailed analysis. Then, it leverages the multi-head attention mechanism of the Transformer model to effectively learn and analyze complex patterns and relationships within the Ethereum transaction graph to identify fraudulent activity more accurately. Our experiments with other models demonstrate the superiority of this model over traditional methods in performance, with an F1 score of 0.9354. By focusing on the challenging aspects of Ethereum’s transaction network, such as its size and intricate connections, DGTSD presents a robust solution for identifying fraudulent activities, significantly contributing to the enhancement of blockchain security.

VORTEX : Visual phishing detectiOns aRe Through EXplanations

Phishing attacks reached a record high in 2022, as reported by the Anti-Phishing Work Group [1], following an upward trend accelerated during the pandemic. Attackers employ increasingly sophisticated tools in their attempts to deceive unaware users into divulging confidential information. Recently, the research community has turned to the utilization of screenshots of legitimate and malicious websites to identify the brands that attackers aim to impersonate. In the field of Computer Vision, convolutional neural networks (CNNs) have been employed to analyze the visual rendering of websites, addressing the problem of phishing detection. However, along with the development of these new models, arose the need to understand their inner workings and the rationale behind each prediction. Answering the question, “How is this website attempting to steal the identity of a well-known brand?” becomes crucial when protecting end-users from such threats. In cybersecurity, the application of explainable AI (XAI) is an emerging approach that aims to answer such questions. In this paper, we propose VORTEX, a phishing website detection solution equipped with the capability to explain how a screenshot attempts to impersonate a specific brand. We conduct an extensive analysis of XAI methods for the phishing detection problem and demonstrate that VORTEX provides meaningful explanations regarding the detection results. Additionally, we evaluate the robustness of our model against Adversarial Example attacks. We adapt these attacks to the VORTEX architecture and evaluate their efficacy across multiple models and datasets. Our results show that VORTEX achieves superior accuracy compared to previous models, and learns semantically meaningful patterns to provide actionable explanations about phishing websites. Finally, VORTEX demonstrates an acceptable level of robustness against adversarial example attacks.

Enhancing IoT Security: Proactive Phishing Website Detection Using Deep Neural Networks

The Internet of Things (IoT) has proven its utility across various domains, including healthcare, agriculture, industry, and finance. It comprises Internet-connected devices that offer remote control capabilities. However, this very connectivity exposes these devices to potential cyberattacks. Cybercriminals can exploit the vulnerabilities in these devices by sending deceptive emails or text messages containing malicious links leading to hacker websites or destructive applications. This allows them unauthorized access to connected devices and the acquisition of sensitive personal information. Such malicious tactics are collectively known as phishing and pose one of the most prevalent threats. This article presents an innovative method that harnesses the power of a Deep Neural Network to accurately classify and proactively prevent phishing websites by analyzing their URLs. The method is demonstrated through a smart home use case, aiming to reinforce IoT security and safeguard users’ sensitive data by proactively identifying and preventing phishing attacks. By harnessing the power of the Deep Learning model, this innovative technique seeks to enhance online safety and protect users from potential cyber threats.

Predict and Optimize Financial Services Risk Using AI-driven Technology

With the rapid development of internet technology, many industries have embarked on a digital transformation. However, while the Internet has brought convenience to users, it has also become a breeding ground for criminals to commit fraud. On the one hand, a large number of users on the Internet more or less left data, criminals can use this information to practice accurate fraud users, improve the success rate of fraud; On the other hand, online financial transactions such as banking and e-commerce also provide more opportunities for criminals to commit fraud. Therefore, all kinds of fraud methods emerge in an endless flow, through the telephone, information, fishing and other means of fraud, not only to bring hundreds of millions of losses to society every year, but also to the security of people's lives have a huge threat. Monitoring and preventing online fraud is an important part of the cybersecurity industry. For known network fraud, based on the domain name of the phishing site, the account number and mobile phone number that send fraudulent information, simple and effective monitoring and defence can be carried out through the blacklist. However, it is difficult for traditional means to effectively defend against undocumented fraud. With the development of machine learning technology, it is the main research direction of fraud detection methods to discover the information sources and characteristics of information content through machine learning technology, and make real-time and continuous accurate judgments. This paper realises credit fraud detection by generating adversarial network technology, so as to prevent network security risks.

Multi-Modal Hierarchical Attention Model for Enhanced Phishing Website Detection

Phishing website attacks persist as a major cyber threat, continually evolving to evade detection. Existing detection methods, such as lookup systems and fraud cue-based approaches, have limitations, prompting the need for advanced techniques capable of addressing these challenges. This paper introduces a novel approach, the Multi-Modal Hierarchical Attention Model (MMHAM), designed to enhance phishing website detection by jointly analysing three crucial modalities: URLs, textual information, and visual design. Traditional lookup systems often fall short in addressing newly created attacks, while fraud cue-based methods may rely heavily on feature engineering, limiting their effectiveness. Deep representation-based methods have shown promise in learning intricate fraud cues, primarily focusing on URLs. However, they neglect the analysis of textual content and visual design, two equally important aspects of website content. MMHAM integrates information from URLs, textual content, and visual design through a shared dictionary learning approach. This innovative mechanism aligns representations from different modalities within the attention model, enabling the model to learn deep fraud cues comprehensively. The proposed MMHAM not only improves phishing detection capabilities but also introduces a hierarchical interpretability system. This system enhances model trustworthiness and provides actionable intelligence for informed decision-making at various levels of phishing threat detection. In our evaluation experiments, MMHAM demonstrated superior performance compared to existing methods, showcasing its ability to learn enhanced deep cues for phishing detection. Furthermore, the hierarchical interpretability system enabled the extraction of valuable phishing threat intelligence. This intelligence can be leveraged to inform phishing website detection strategies at different levels, empowering cybersecurity professionals with a more robust and adaptable defines against phishing attacks. The MMHAM model represents a significant step forward in the ongoing effort to combat the evolving landscape of cyber threats, particularly in the realm of phishing website detection.

Advancing Phishing Email Detection: A Comparative Study of Deep Learning Models.

Phishing is one of the most dangerous attacks targeting individuals, organizations, and nations. Although many traditional methods for email phishing detection exist, there is a need to improve accuracy and reduce false-positive rates. Our work investigates one-dimensional CNN-based models (1D-CNNPD) to detect phishing emails in order to address these challenges. Additionally, further improvement is achieved with the augmentation of the base 1D-CNNPD model with recurrent layers, namely, LSTM, Bi-LSTM, GRU, and Bi-GRU, and experimented with the four resulting models. Two benchmark datasets were used to evaluate the performance of our models: Phishing Corpus and Spam Assassin. Our results indicate that, in general, the augmentations improve the performance of the 1D-CNNPD base model. Specifically, the 1D-CNNPD with Bi-GRU yields the best results. Overall, the performance of our models is comparable to the state of the art of CNN-based phishing email detection. The Advanced 1D-CNNPD with Leaky ReLU and Bi-GRU achieved 100% precision, 99.68% accuracy, an F1 score of 99.66%, and a recall of 99.32%. We observe that increasing model depth typically leads to an initial performance improvement, succeeded by a decline. In conclusion, this study highlights the effectiveness of augmented 1D-CNNPD models in detecting phishing emails with improved accuracy. The reported performance measure values indicate the potential of these models in advancing the implementation of cybersecurity solutions to combat email phishing attacks.

Cyber Crimes during COVID-19 Pandemic

The COVID-19 pandemic has accelerated the use of digital technologies online website causing significant changes in the way we live and work. While these developments provide the necessary tools for remote working, education and communication, they also create new opportunities for cybercriminals. This content explores the emergence and evolution of cybercrime in the context of the COVID-19 pandemic Examines increasingly common types of cybercrimes, including phishing attacks, ransomware, and online fraud. The details also reveal the motivation behind these cybercrimes, from financial gain to exploiting fear and uncertainty. It also emphasizes the importance of cybersecurity knowledge and measures to protect people, organizations and critical system in the digital age. Has the world’s grapple with the ongoing pandemic combating cybercrimes has become important parts of our response to this crisis.