Phishing Detection Approach Research Articles

Illegitimate Websites Detection Using Deep Learning Framework

Phishing is a crime involving robbery of confidential user data. The phishing websites are aimed at individuals, businesses, and cloud storage and government websites. Hardware- based anti-phishing methods are generally used, but software- based approaches are favored because of costs and operational factors. There is no solution to the problem such as zero-day phishing attacks from current phishing detection approaches. A three-phase attack detection called the Phishing Attack Detector based on Web Crawler was proposed to resolve these problems and precisely detect phishing incidences using recurrent neural network. It includes the input features Web traffic, web content and Uniform Resource Locator (URL) based on the classification of phishing and non-phishing pages

Phishing URL Detection: A Basic Machine Learning Approach

Phishing is currently one of the most trending scam attacks in information transmission worldwide. Such occurrences can cause severe network disruption to corporate organizations, financial and/or educational institutions and even individual network subscribers. Phishing attacks would normally involve developing a malicious webpage mimicking a legitimate website. This lures unsuspecting users into giving out personal information, such as banking details, social security numbers, passwords, usernames, etc. A phishing fraudster sends an e-mail or text message to a target webpage that contains its Universal Resource Locator (URL). The result could be monetary loss, data breach, intellectual property theft, damaged reputation, and loss of customers. In this paper, we propose a simple phishing detection approach. Moreover, because the impostor is always evolving attacking techniques in a bid to evade detection, our method addresses this using a supervised machine learning system. From the website content, we extract the stochastic dynamical patterns and then use this to predict the authenticity of the website. The Extreme Gradient Boosting (XGBoost) algorithm is used to model the website features to obtain a better prediction result. The proposed technique can detect phishing websites with an accuracy of 86.6%.

Hybrid optimization enabled squeeze net for phishing attack detection

Nowadays, phishing attacks are considered as one of the most common cyber-attacks which generally harm the security of various internet and communication systems. The phishing websites are produced with the intention of determining the user's financial information by creating cyber threats. The loss of valuable user assets occurs due to the frequent creation and circulation of fake websites all over the internet. The negative impacts of phishing websites include financial loss, loss of intellectual property, reputational harm, and interruption of daily operations. To identify and lessen these attempts, several anti-phishing strategies have been put forth during the past ten years. However, they are still inaccurate and inefficient. To overcome this problem, intelligent approaches, like Deep Learning (DL) is used, which can accurately learn the inherent characteristics of the websites and identify phishing websites. In this paper, the phishing websites are determined effectively using the Fractional Dingo Hunter Prey Optimization-SqueezeNet (FDHPO-SqueezeNet) technique. The different features, like web features, ocular features, and Natural Language Processing (NLP) features are extracted separately from the website data. Later, the optimal features are selected, fused, and augmented, and allowed for the detection of phishing websites using SqueezeNet. Finally, the phishing detection is performed using SqueezeNet, where the detection performance of the SqueezeNet is increased by training using the FDHPO technique. The investigation results revealed that the designed FDHPO-SqueezeNet technique recorded greater performance when compared with other prevailing phishing detection approaches with a maximal of 93.05 % accuracy, 94.26 % sensitivity, and 93.75 % specificity, respectively.

A Review on Online Phishing Detection Using Machine Learning

Abstract: The rapid growth of the internet and the increasing dependence on online services have led to a significant rise in cyber threats, with phishing attacks being a prevalent and pervasive threat. Phishing attacks often involve the use of deceptive techniques to trick users into divulging sensitive information, such as login credentials, credit card details, and personal information. Detecting and preventing phishing attacks in real-time has become a critical challenge for individuals, businesses, and organizations. This research paper presents an approach for online phishing detection using machine learning techniques. The primary objective is to develop a system that can automatically identify and classify phishing websites and emails, thereby enhancing cyber security and protecting users from falling victim to these malicious activities. Online phishing detection has gained significant importance, which will only grow with the amount of dependency on cyberspace, the proposed system provides an easy solution, during cases when the user is unsure about the authenticity of the website visited, they can try to copy the Uniform Resource Locator (URL) and paste the link into the online phishing detection system. Through the system process, it will help the user to identify whether given links were legitimate website or it is a phishing website. Therefore, the user will not be in a doubtful situation the whole day in wondering whether the information they gave in a certain website is safe or not. Providing complex decision with simplicity, the system will help the user to detect each variable of URL given accurate.

A Hybrid Approach for Alluring Ads Phishing Attack Detection Using Machine Learning.

Phishing attacks are evolving with more sophisticated techniques, posing significant threats. Considering the potential of machine-learning-based approaches, our research presents a similar modern approach for web phishing detection by applying powerful machine learning algorithms. An efficient layered classification model is proposed to detect websites based on their URL structure, text, and image features. Previously, similar studies have used machine learning techniques for URL features with a limited dataset. In our research, we have used a large dataset of 20,000 website URLs, and 22 salient features from each URL are extracted to prepare a comprehensive dataset. Along with this, another dataset containing website text is also prepared for NLP-based text evaluation. It is seen that many phishing websites contain text as images, and to handle this, the text from images is extracted to classify it as spam or legitimate. The experimental evaluation demonstrated efficient and accurate phishing detection. Our layered classification model uses support vector machine (SVM), XGBoost, random forest, multilayer perceptron, linear regression, decision tree, naïve Bayes, and SVC algorithms. The performance evaluation revealed that the XGBoost algorithm outperformed other applied models with maximum accuracy and precision of 94% in the training phase and 91% in the testing phase. Multilayer perceptron also worked well with an accuracy of 91% in the testing phase. The accuracy results for random forest and decision tree were 91% and 90%, respectively. Logistic regression and SVM algorithms were used in the text-based classification, and the accuracy was found to be 87% and 88%, respectively. With these precision values, the models classified phishing and legitimate websites very well, based on URL, text, and image features. This research contributes to early detection of sophisticated phishing attacks, enhancing internet user security.

Look before you leap: Detecting phishing web pages by exploiting raw URL and HTML characteristics

Phishing websites distribute unsolicited content and are frequently used to commit email and internet fraud. Detecting them before any user information is submitted is critical. Several efforts have been made to detect these phishing websites in recent years. Most existing approaches use hand-crafted lexical and statistical features from a website’s textual content to train classification models to detect phishing web pages. However, these phishing detection approaches have limitations, including (1) the tediousness of extracting hand-crafted features, which require specialized domain knowledge to determine which features are useful for a particular platform; and (2) the difficulties encountered by models built on hand-crafted features to capture the semantic patterns in words and characters in URL and HTML content. To address these challenges, this paper proposes WebPhish, an end-to-end deep neural network trained using embedded raw URLs and HTML content to detect website phishing attacks. First, the proposed model automatically employs an embedding technique to extract the corresponding characters into homologous dense vectors. Then, the concatenation layer merges the URL and HTML embedding matrices. Following that, Convolutional layers are used to model its semantic dependencies. Extensive experiments were conducted with real-world phishing data, which yielded an accuracy of 98.1%, showing that WebPhish outperforms baseline detection approaches in identifying phishing pages.

An enhanced deep learning‐based phishing detection mechanism to effectively identify malicious URLs using variational autoencoders

AbstractPhishing attacks have become one of the powerful sources for cyber criminals to impose various forms of security attacks in which fake website Uniform Resource Locators (URL) are circulated around the Internet community in the form of email, messages etc., in order to deceive users, resulting in the loss of their valuable assets. The phishing URLs are predicted using several blacklist‐based traditional phishing website detection techniques. However, numerous phishing websites are frequently constructed and launched on the Internet over time; these blacklist‐based traditional methods do not accurately predict most phishing websites. In order to effectively identify malicious URLs, an enhanced deep learning‐based phishing detection approach has been proposed by integrating the strength of Variational Autoencoders (VAE) and deep neural networks (DNN). In the proposed framework, the inherent features of a raw URL are automatically extracted by the VAE model by reconstructing the original input URL to enhance phishing URL detection. For experimentation, around 1 lakh URLs were crawled from two publicly available datasets, namely ISCX‐URL‐2016 dataset and Kaggle dataset. The experimental results suggested that the proposed model has reached a maximum accuracy of 97.45% and exhibits a quicker response time of 1.9 s, which is better when compared to all the other experimented models.

Business Email Compromise Phishing Detection Based on Machine Learning: A Systematic Literature Review

The risk of cyberattacks against businesses has risen considerably, with Business Email Compromise (BEC) schemes taking the lead as one of the most common phishing attack methods. The daily evolution of this assault mechanism’s attack methods has shown a very high level of proficiency against organisations. Since the majority of BEC emails lack a payloader, they have become challenging for organisations to identify or detect using typical spam filtering and static feature extraction techniques. Hence, an efficient and effective BEC phishing detection approach is required to provide an effective solution to various organisations to protect against such attacks. This paper provides a systematic review and examination of the state of the art of BEC phishing detection techniques to provide a detailed understanding of the topic to allow researchers to identify the main principles of BEC phishing detection, the common Machine Learning (ML) algorithms used, the features used to detect BEC phishing, and the common datasets used. Based on the selected search strategy, 38 articles (of 950 articles) were chosen for closer examination. Out of these articles, the contributions of the selected articles were discussed and summarised to highlight their contributions as well as their limitations. In addition, the features of BEC phishing used for detection were provided, as well as the ML algorithms and datasets that were used in BEC phishing detection models were discussed. In the end, open issues and future research directions of BEC phishing detection based on ML were discussed.

Applications of deep learning for phishing detection: a systematic literature review.

Phishing attacks aim to steal confidential information using sophisticated methods, techniques, and tools such as phishing through content injection, social engineering, online social networks, and mobile applications. To avoid and mitigate the risks of these attacks, several phishing detection approaches were developed, among which deep learning algorithms provided promising results. However, the results and the corresponding lessons learned are fragmented over many different studies and there is a lack of a systematic overview of the use of deep learning algorithms in phishing detection. Hence, we performed a systematic literature review (SLR) to identify, assess, and synthesize the results on deep learning approaches for phishing detection as reported by the selected scientific publications. We address nine research questions and provide an overview of how deep learning algorithms have been used for phishing detection from several aspects. In total, 43 journal articles were selected from electronic databases to derive the answers for the defined research questions. Our SLR study shows that except for one study, all the provided models applied supervised deep learning algorithms. The widely used data sources were URL-related data, third party information on the website, website content-related data, and email. The most used deep learning algorithms were deep neural networks (DNN), convolutional neural networks, and recurrent neural networks/long short-term memory networks. DNN and hybrid deep learning algorithms provided the best performance among other deep learning-based algorithms. 72% of the studies did not apply any feature selection algorithm to build the prediction model. PhishTank was the most used dataset among other datasets. While Keras and Tensorflow were the most preferred deep learning frameworks, 46% of the articles did not mention any framework. This study also highlights several challenges for phishing detection to pave the way for further research.

Deep Learning Based Phishing Websites Detection

Phishing is a crime that involves the theft of confidential user information. Those targeted by phishing websites include individuals, small businesses, cloud storage providers, and government organisations and websites. The majority of phishing prevention techniques involve hardware-based solutions, although software-based options are preferred due of cost and operational considerations. There is no answer to the problem of zero-day phishing assaults from the present phishing detection approaches since there is no solution to the problem. The Phishing Attack Detector based on Web Crawler, a three-phase attack detection system, was designed to handle these issues and accurately detect phishing incidences using a recurrent neural network in order to resolve these issues. It covers the input aspects of web traffic, web content, and Uniform Resource Locator (URL) based on the classification of phishing and non-phishing pages, as well as the output features of phishing and non-phishing pages.

Modeling Hybrid Feature-Based Phishing Websites Detection Using Machine Learning Techniques

In this paper, we mainly present a machine learning based approach to detect real-time phishing websites by taking into account URL and hyperlink based hybrid features to achieve high accuracy without relying on any third-party systems. In phishing, the attackers typically try to deceive internet users by masking a webpage as an official genuine webpage to steal sensitive information such as usernames, passwords, social security numbers, credit card information, etc. Anti-phishing solutions like blacklist or whitelist, heuristic, and visual similarity based methods cannot detect zero-hour phishing attacks or brand-new websites. Moreover, earlier approaches are complex and unsuitable for real-time environments due to the dependency on third-party sources, such as a search engine. Hence, detecting recently developed phishing websites in a real-time environment is a great challenge in the domain of cybersecurity. To overcome these problems, this paper proposes a hybrid feature based anti-phishing strategy that extracts features from URL and hyperlink information of client-side only. We also develop a new dataset for the purpose of conducting experiments using popular machine learning classification techniques. Our experimental result shows that the proposed phishing detection approach is more effective having higher detection accuracy of 99.17% with the XG Boost technique than traditional approaches.

HinPhish: An Effective Phishing Detection Approach Based on Heterogeneous Information Networks

Internet users have suffered from phishing attacks for a long time. Attackers deceive users through malicious constructed phishing websites to steal sensitive information, such as bank account numbers, website usernames, and passwords. In recent years, many phishing detection solutions have been proposed, which mainly leverage whitelists or blacklists, website content, or side channel-based techniques. However, with the continuous improvement of phishing technology, current methods have difficulty in achieving effective detection. Hence, in this paper, we propose an effective phishing website detection approach, which we call HinPhish. HinPhish extracts various link relationships from webpages and uses domains and resource objects to construct a heterogeneous information network. HinPhish applies a modified algorithm to leverage the characteristics of different link types in order to calculate the phish-score of the target domain on the webpage. Moreover, HinPhish not only improves the accuracy of detection, but also can increase the phishing cost for attackers. Extensive experimental results demonstrate that HinPhish can achieve an accuracy of 0.9856 and F1-score of 0.9858.

An adaptive approach for internet phishing detection based on log data

The Internet has become one of the most important daily socials, financial and other activities. the number of customers who use the Internet to conduct their business and purchases is very large. This results in billions of dollars being transferred every day online. Such a large amount of money attracts the attention of cybercriminals to carry out their illegal activities. “Fraud” is one of the most dangerous of these methods, especially phishing, where attackers try to steal user credentials using fraudulent emails, fake websites, or both. The proposed system for this paper includes efficient data extraction from the web file through data collection and preprocessing. and web usage mining procedure to extract features that demonstrate user behavior. and feature-extracting URL analysis to detect website phishing addresses. After that, the features from the above two parts are combined to make the number of features sixty-three. Finally, a classification algorithm (Random Forests) is applied to determine if website addresses are phishing or legitimate. Suggested algorithms performance is determined by using a confusion matrix and a number of metrics that shows the robustness of the proposed system.

A novel approach for phishing URLs detection using lexical based machine learning in a real-time environment

In recent times, we can see a massive increase in the number of devices that are being connected to the internet. These devices include but are not limited to smartphones, IoT, and cloud networks. In comparison to other possible cyber-attacks, these days, hackers are targeting these devices with phishing attacks since it exploits human vulnerabilities rather than system vulnerabilities. In a phishing attack, an online user is deceived by a seemingly trusted entity to give their personal data, i.e., login credentials or credit card details. When this private information is leaked to the hackers, this information becomes the source of other sophisticated attacks. In recent times many researchers have proposed the machine learning-based approach to solve phishing attacks; however, they have used a large number of features to develop reliable phishing detection techniques. A large number of features requires large processing powers to detect phishing, which makes it very much unsuitable for resource constrained devices. To address this issue, we have developed a phishing detection approach that only needs nine lexical features for effectively detecting phishing attacks. We used ISCXURL-2016 dataset for our experimental purpose, where 11964 instances of legitimate and phishing URLs are used. We have tested our approach against different machine learning classifiers and have obtained the highest accuracy of 99.57% with the Random forest algorithm.

Phishing website detection based on effective machine learning approach

ABSTRACT Phishing a form of cyber-attack, which has an adverse effect on people where the user is directed to fake websites and duped to reveal their sensitive and personal information which includes passwords of accounts, bank details, atm pin-card details etc. Hence protecting sensitive information from malwares or web phishing is difficult. Machine learning is a study of data analysis and scientific study of algorithms, which has shown results in recent times in opposing phishing pages when distinguished with visualization, legal solutions, including awareness workshops and classic anti-phishing approaches. This paper examines the applicability of ML techniques in identifying phishing attacks and report their positives and negatives. In specific, there are many ML algorithms that have been explored to declare the appropriate choice that serve as anti-phishing tools. We have designed a Phishing Classification system which extracts features that are meant to defeat common phishing detection approaches. We also make use of numeric representation along with the comparative study of classical machine learning techniques like Random Forest, K nearest neighbours, Decision Tree, Linear SVC classifier, One class SVM classifier and wrapper-based features selection which contains the metadata of URLs and use the information to determine if a website is legitimate or not.

The Answer is in the Text: Multi-Stage Methods for Phishing Detection Based on Feature Engineering

A phishing attack is a threat based on fraudulent communication, usually by e-mail, where the cybercriminals, impersonating a trusted person or organization, try to lure and coax a target. Phishing detection approaches that obtain highly representational features from the text of these e-mails are a suitable strategy to counter these threats since these features can be used to train machine learning algorithms, thus generating models able to classify mail samples as phishing or legitimate messages. This paper proposes a multi-stage approach to detect phishing e-mail attacks using natural language processing and machine learning. The proposed multi-stage approach consists of feature engineering within natural language processing, lemmatization, feature selection, feature extraction, improved learning techniques for resampling and cross-validation, and the configuration of hyperparameters. We present two methods of the proposed approach, the first one exploiting the Chi-Square statistics and the Mutual Information to improve the dimensionality reduction, while the second method associates Principal Component Analysis (PCA) and Latent Semantic Analysis (LSA). Both methods handle the problems of the “curse of dimensionality”, the sparsity, and the amount of information that must be obtained from the context in the Vector Space Model (VSM) representation. These methods yield reduced feature sets that, combined with the XGBoost and Random Forest machine learning algorithms, lead to an F1-measure of 100% success rate, for validation tests with the SpamAssassin Public Corpus and the Nazario Phishing Corpus datasets. Even considering just the text in e-mail bodies, the proposed multi-stage phishing detection approach outperforms state-of-the-art schemes for an accredited data set, requiring a much smaller number of features and presenting lower computational cost.

Optimization of URL-Based Phishing Websites Detection through Genetic Algorithms

Website phishing is an online crime for obtaining secret information such as passwords, account numbers, and credit card details. Attackers lure users through attractive hyperlinks, in order to, redirect to the fake websites. Phishing detection through a machine-learning approach has become quite effective nowadays. In this research, the Uniform Resource Locator (URL) based phishing detection approach has been used. Machine-learning classifiers like Naive Bayes, Iterative Dichotomiser-3 (ID3), K-Nearest Neighbor (KNN), Decision Tree and Random Forest used for the classification of legitimate and illegitimate websites. This classification would help in the detection of phishing websites. However, it has been observed that use of Genetic Algorithms (GAs) for feature selection can improve the detection accuracy. Our experimental results portrayed the use of Iterative Dichotomiser-3 (ID3) along with Yet Another Generating Genetic Algorithm (YAGGA) improves the detection accuracy up to 95%.

A Case-Based Reasoning Approach for Automatic Adaptation of Classifiers in Mobile Phishing Detection

Currently, the smartphone contains lots of sensitive information. The increasing number of smartphone usage makes it more interesting for phishers. Existing phishing detection techniques are performed on their specific features with selected classifiers to get their best accuracy. An effective phishing detection approach is required to adapt the concept drift of mobile phishing and prevent degradation in accuracy. In this work, an adaptive phishing detection approach based on case-based reasoning technique is proposed to handle the concept drift challenge in phishing apps. Several experiments are conducted in order to demonstrate the design decision of our proposed model. The proposed model is evaluated with a large feature set containing 1,065 features from 10 different categories. These features are extracted from more than 10,000 android applications. Five combinations of features are created in order to mimic new real-world Android apps to evaluate our experiments. Moreover, a reduced feature set is also studied in this work in order to improve the efficiency of the proposed model. Both accuracy and efficiency of the proposed model are evaluated. The experimental results show that our proposed model achieves acceptable accuracy and efficiency for the phishing detection.

Classifier Performance Evaluation of Phishing Detection Model on Optimal Number of Clusters

The vast usage of internet among people facilitate huge amount of online transactions in day to day life. This necessitates millions of users to be involved by submitting their information such as username, password, and banking credentials through online. The availability of such huge personal information attracts and motivates cybercriminals to launch their cyber attacks in online networks to steal the information for their further financial crimes. Among these attacks, phishing is a kind of attack where phisher sets down a fake website that appears similar to legitimate website and sends bogus mail to targeted victims in order to pilfer their information. Such an act leads to potential loss of user credentials and reputation of the corresponding organization. The existing phishing detection approaches which rely on classifier performance have low detection rate due to the uncertainty present in the huge training dataset. Therefore, it is intuitive that if the uncertainty is reduced then the performance could be improved. Further, In this paper, clustering is used to obtain the inherent structure of the datapoints prior to classification. The clustering algorithms, viz., k-means and k-medians were run for different number of cluster values ‘k’. The silhouette criterion was used to find the optimal number of clusters present in the dataset. The classifiers, Decision Tree (DT), Random Forest (RF), and Support Vector Machine (SVM) were trained for each optimal cluster range. The performance of the trained model for the corresponding classifier is analyzed in terms of detection rate, sensitivity, specificity, and error rate. From the experimental results, it is observed that the performance of the classifier is improved better when it was combined with the optimal number of clusters rather than with the arbitrary cluster range.

Phishing Website Detection Based on Multidimensional Features Driven by Deep Learning

As a crime of employing technical means to steal sensitive information of users, phishing is currently a critical threat facing the Internet, and losses due to phishing are growing steadily. Feature engineering is important in phishing website detection solutions, but the accuracy of detection critically depends on prior knowledge of features. Moreover, although features extracted from different dimensions are more comprehensive, a drawback is that extracting these features requires a large amount of time. To address these limitations, we propose a multidimensional feature phishing detection approach based on a fast detection method by using deep learning. In the first step, character sequence features of the given URL are extracted and used for quick classification by deep learning, and this step does not require third-party assistance or any prior knowledge about phishing. In the second step, we combine URL statistical features, webpage code features, webpage text features, and the quick classification result of deep learning into multidimensional features. The approach can reduce the detection time for setting a threshold. Testing on a dataset containing millions of phishing URLs and legitimate URLs, the accuracy reaches 98.99%, and the false positive rate is only 0.59%. By reasonably adjusting the threshold, the experimental results show that the detection efficiency can be improved.