Phishing Detection Research Articles

Phishing Email Detection Using Improved RCNN with Multilevel Vectors and Attention Mechanism

Abstract: The Phishing emails are the common threats in the present world which leads to the financial losses and stealing the sensitive information like credit card details, username and password etc. Due to increase in the rate of phishing emails there is a need to introduce the effective phishing detection technology. In order to detect the phishing emails many methods, techniques and technologies are introduced .Improved RCNN with multilevel vectors and attention mechanism is one such technology. Firstly, the email structure is analyzed and then by using RCNN model with multilevel vectors ,attention mechanism phishing content is detected .we introduce noise to test the effectiveness.

Visual similarity-based phishing detection using deep learning

Phishing is a common cybercrime that tempts a target to reveal personal and financial information by imitating a legitimate webpage. Classical techniques, such as list-based, and heuristic approaches have focused on identifying the uniform resource locator (URL). However, cybercriminals have uncovered several methods to evade URL-based techniques. Recently, researchers have started developing techniques that are based on visual similarity to detect phishing webpages. However, using visual similarity raises several computer vision-related issues such as webpage segmentation and feature extraction. Deep learning provides a suitable solution to these issues as it integrates feature extraction, feature selection, and classification in an end-to-end system. We have made the first attempt to detect phishing webpages based on visual similarity by modifying and retraining deep neural networks. A comprehensive evaluation on two publicly available databases has shown a marked improvement of around 7% classification accuracy.

Holding Your Hand on the Danger Button

Phishing emails continue to be a major cause of cybersecurity breaches despite the development of technical measures designed to thwart these attacks. Most phishing studies have investigated desktop email platforms, but the use of mobile devices for email exchanges has soared in recent years, especially amongst young adults. In this paper, we explore how the digital platform (desktop vs. mobile) influences users' phish detection strategies. Twenty-one young adults (18-25 years) were asked to rate the legitimacy of emails using a live inbox test while using a think-aloud protocol on both platforms. Our results suggest that a lack of knowledge about key defence information on the mobile platform results in weak phish detection. We discuss the implications of these findings and offer design recommendations to support effective phish detection by smartphone users.

Homoglyph Attack Detection Model Using Machine Learning and Hash Function

Phishing is still a major security threat in cyberspace. In phishing, attackers steal critical information from victims by presenting a spoofing/fake site that appears to be a visual clone of a legitimate site. Several Unicode characters are visually identical to ASCII characters. This similarity in characters is generally known as homoglyphs. Malicious adversaries utilize homoglyphs in URLs and DNS domains to target organizations. To reduce the risks caused by phishing attacks, effective ways of detecting phishing websites are urgently required. This paper proposes a homoglyph attack detection model that combines a hash function and machine learning. There are two phases to the model approach. The machine was being trained during the development phase. The deployment phase involved deploying the model with a Java interface and testing the outcomes through actual user interaction. The results are more accurate when the URL is hashed, as any little changes to the URL can be recognized. The homoglyph detector can be developed as a stand-alone software that is used as the initial step in requesting a webpage as it enhances browser security and protects websites from phishing attempts. To verify the effectiveness, we compared the proposed model on several criteria to existing phishing detection methods. By using the hash function, the proposed security features increase the overall security of the homoglyph attack detection in terms of accuracy, integrity, and availability. The experiment results showed that the model can detect phishing sites with an accuracy of 99.8% using Random Forest, and the hash function improves the accuracy of homoglyph attack detection.

A Novel Logo Identification Technique for Logo-Based Phishing Detection in Cyber-Physical Systems

The first and foremost task of a phishing-detection mechanism is to confirm the appearance of a suspicious page that is similar to a genuine site. Once this is found, a suitable URL analysis mechanism may lead to conclusions about the genuineness of the suspicious page. To confirm appearance similarity, most of the approaches inspect the image elements of the genuine site, such as the logo, theme, font color and style. In this paper, we propose a novel logo-based phishing-detection mechanism that characterizes the existence and unique distribution of hue values in a logo image as the foundation to unambiguously represent a brand logo. Using the proposed novel feature, the detection mechanism optimally classifies a suspicious logo to the best matching brand logo. The experiment is performed over our customized dataset based on the popular phishing brands in the South-Asia region. A set of five machine-learning algorithms is used to train and test the prepared dataset. We inferred from the experimental results that the ensemble random forest algorithm achieved the high accuracy of 87% with our prepared dataset.

Phish Responder: A Hybrid Machine Learning Approach to Detect Phishing and Spam Emails

Using technology to prevent cyber-attacks has allowed organisations to somewhat automate cyber security. Despite solutions to aid organisations, many are susceptible to phishing and spam emails which can make an unwanted impact if not mitigated. Traits that make organisations susceptible to phishing and spam emails include a lack of awareness around the identification of malicious emails, explicit trust, and the lack of basic security controls. For any organisation, phishing and spam emails can be received and the consequences of an attack could result in disruption. This research investigated the threat of phishing and spam and developed a detection solution to address this challenge. Deep learning and natural language processing are two techniques that have been employed in related research, which has illustrated improvements in the detection of phishing. Therefore, this research contributes by developing Phish Responder, a solution that uses a hybrid machine learning approach combining natural language processing to detect phishing and spam emails. To ensure its efficiency, Phish Responder was subjected to an experiment in which it has achieved an average accuracy of 99% with the LSTM model for text-based datasets. Furthermore, Phish Responder has presented an average accuracy of 94% with the MLP model for numerical-based datasets. Phish Responder was evaluated by comparing it with other solutions and through an independent t-test which demonstrated that the numerical-based technique is statistically significantly better than existing approaches.

Evolutionary Algorithm with Deep Auto Encoder Network Based Website Phishing Detection and Classification

Website phishing is a cyberattack that targets online users for stealing their sensitive data containing login credential and banking details. The phishing websites appear very similar to their equivalent legitimate websites for attracting a huge amount of Internet users. The attacker fools the user by offering the masked webpage as legitimate or reliable for retrieving its important information. Presently, anti-phishing approaches necessitate experts to extract phishing site features and utilize third-party services for phishing website detection. These techniques have some drawbacks, as the requirement of experts for extracting phishing features is time consuming. Many solutions for phishing websites attack have been presented, such as blacklist or whitelist, heuristics, and machine learning (ML) based approaches, which face difficulty in accomplishing effectual recognition performance due to the continual improvements of phishing technologies. Therefore, this study presents an optimal deep autoencoder network based website phishing detection and classification (ODAE-WPDC) model. The proposed ODAE-WPDC model applies input data pre-processing at the initial stage to get rid of missing values in the dataset. Then, feature extraction and artificial algae algorithm (AAA) based feature selection (FS) are utilized. The DAE model with the received features carried out the classification process, and the parameter tuning of the DAE technique was performed using the invasive weed optimization (IWO) algorithm to accomplish enhanced performance. The performance validation of the ODAE-WPDC technique was tested using the Phishing URL dataset from the Kaggle repository. The experimental findings confirm the better performance of the ODAE-WPDC model with maximum accuracy of 99.28%.

Roles and Challenges of AI-Based Cybersecurity: A Case Study

Nowadays, organizations face complex cyber-attacks that are difficult to counter with traditional protections. Therefore, many modern organizations tend to use AI-based cybersecurity systems to secure their assets and infrastructure and to reduce the level of potential risks.
 Because of the lack of clarity of the AI roles in cybersecurity and the ambiguity of the related challenges, this study aims to explore the most prominent roles of AI-based cybersecurity related to information security in the prevention phase, the detection phase and the response phase. The study also aims to determine the most prominent challenges facing AI-based cybersecurity.
 To achieve the goals of this study, we adopt a case-study methodology that origins from the general framework which is information security and ends with the specific framework which is AI-based cybersecurity. After designing a matrix to analyze the case study, the study concludes nine important roles for AI-based cybersecurity distributed over the three phases. Three roles are in the prevention phase, which are automated assessment of security vulnerabilities, awareness and training and authentication. Two roles are in the detection phase; namely, detection of intrusion and security breaches and detection of spams and phishing and four rules are in the response stage, which are analyzing malware, automating routine tasks, deploying traps and topple attackers and isolating important assets.
 The study also identifies eight elements that represent the most prominent challenges facing AI-based cybersecurity: regulations and principles, trust, accountability, privacy, bias, training datasets, human resources and financial costs. In conclusion, the study presents a set of recommendations drawn from the results.

A Comparative Study on Detection of Malware and Benign on the Internet Using Machine Learning Classifiers

The exponential growth in network usage has opened the way for people who use the Internet to be exploited. A phishing attack is the most effective way to obtain sensitive information about a target individual without their knowledge over the Internet. Phishing detection has an increased false-positive rate and is inaccurate. The motivation behind the research is to analyze and classify the applications among malware or benign with less time complexity. The main purpose is to find the algorithm which provides better accuracy for detecting the adware. The comparative analysis was made with three machine learning classifiers to find a better one. Random forest, SVM, and naïve Bayes were selected because of the better results obtained in previous research papers. Using a confusion matrix, the classifier methods were evaluated for accuracy, precision, recall, and F-measure with positive rates of both true and false. This research indicates that there are a number of classifiers that, if accurately detected, offer better reliable phishing detection outcomes. Random forest has proven to be an effective classifier with 0.9947 accuracy and a 0.017 false-positive rate. In this study, the comparative analysis reveals that the best ML classifiers have a lesser prediction accuracy for spoofing threat identification, implying that nonphishing programmers can use the best ML classifiers to evaluate the attributes of spoofing threat recognition and classification.

URL’S Phishing Detection Based on Machine Learning Approach

Phishing detection is a challenging problem, and many different solutions are proposed in a market as a blacklist, rule-based detection, anomaly-based detection etc. Phishing Websites are duplicate webpages created to mimic real websites in-order to deceive people to get their personal information. Because of the adaptability of their tactics with little cost detecting and identifying phishing websites is really a obscure and dynamic problem.

Phishing Detection

The phishing email is one of the significant threats in the world today and has caused tremendous financial losses. Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. Although the methods of confrontation are continually being updated, the results of those methods are not very satisfactory at present. Moreover, phishing emails are growing at an alarming rate in recent years. Therefore, more effective phishing detection technology is needed to curb the threat of phishing emails. So There are many ways to detect these phishing mails nowadays using Machine Learning. so using the phishing mail detector where these links could be tested and then predicted and to detect whether it is a spam or not. Keywords: Phishing mail, Social engineering, Machine learning

Phishing Website Detection

It is a crime to practice phishing by employing technical tricks and social engineering to exploit the innocence of unaware users. This methodology usually covers up a trustworthy entity so as to influence a consumer to execute an action if asked by the imitated entity. Most of the times, phishing attacks are being noticed by the practiced users but security is a main motive for the basic users as they are not aware of such circumstances. However, some methodologies are limited to look after the phishing attacks only and the delay in detection is mandatory. In this paper we emphasize the various techniques used for the detection of phishing attacks. We have also discovered various techniques for detection and prevention of phishing. Apart from that, we have introduced a new model for detection and prevention of phishing attacks.

An Empirical Study Towards an Automatic Phishing Attack Detection Using Ensemble Stacking Model

Phishing attacks are one of the most attacks facing internet users, especially after the COVID-19 pandemic, as most organizations have transferred part or most of their work and communication to become online using well-known tools, like email, Zoom, WebEx, etc. Therefore, cyber phishing attacks have become progressively recent, directly and frankly reflecting the designated website, allowing the attacker to observe everything while the victim is exploring Webpages. Hence, utilizing Artificial Intelligence (AI) techniques has become a necessary approach that could be used to detect such attacks automatically. In this paper, we introduce an empirical analysis for automatic phishing detection using several machine learning classification algorithms compared with an ensemble learning model for detecting phishing sites based on the uniform resource locator (URL) using two preprocessed datasets. In this empirical study, we concluded that the ensemble model grants accuracy 97.49% for dataset 1 and 98.69% for dataset 2, which gives higher accuracy than using a single machine learning classification algorithm such as Naive Bayes (NB), Random Forest (RF), Decision Trees (DTs), K-Nearest Neighbors (KNN), and linear and Quadratic Discriminant Analysis. We also compared the proposed ensemble model with one of the most recent similar models.

Phishing email detection using deep learning algorithms

E-mail is one of the most widely recognised channels of communication, whether for personal or corporate purposes. The worst part about spam emails is that they intrude on user’s privacy without their consent, and the constant bombardment of spam mails fills up the user's entire email space. Additionally, the issue of wasting network capacity and time checking and deleting spam mails makes it an even more concerning issue. Although confrontation tactics are constantly being upgraded, the results of those methods are now unsatisfactory. Furthermore, phishing emails have been on the rise in recent years. To combat the issue of phishing emails, more effective phishing detection technology is required. We intend to create a phishing email detection tool that analyses the email structure first, using an upgraded Convolutional Neural Networks model with multilayer vectors and Long Short-Term Neural Network (LSTM) to model emails at the email header, character level, email content, and word level all at the same time. To assess the efficacy, we'll use an unbalanced dataset with actual phishing and genuine email ratios. The total accuracy of the experiment achieves a high percentage.

CCBLA: a Lightweight Phishing Detection Model Based on CNN, BiLSTM, and Attention Mechanism

CCBLA: a Lightweight Phishing Detection Model Based on CNN, BiLSTM, and Attention Mechanism

An intelligent cyber security phishing detection system using deep learning techniques.

Recently, phishing attacks have become one of the most prominent social engineering attacks faced by public internet users, governments, and businesses. In response to this threat, this paper proposes to give a complete vision to what Machine learning is, what phishers are using to trick gullible users with different types of phishing attacks techniques and based on our survey that phishing emails is the most effective on the targeted sectors and users which we are going to compare as well. Therefore, more effective phishing detection technology is needed to curb the threat of phishing emails that are growing at an alarming rate in recent years, thus will discuss the techniques of mitigation of phishing by Machine learning algorithms and technical solutions that have been proposed to mitigate the problem of phishing and valuable awareness knowledge users should be aware to detect and prevent from being duped by phishing scams. In this work, we proposed a detection model using machine learning techniques by splitting the dataset to train the detection model and validating the results using the test data , to capture inherent characteristics of the email text, and other features to be classified as phishing or non-phishing using three different data sets, After making a comparison between them, we obtained that the most number of features used the most accurate and efficient results achieved. the best ML algorithm accuracy were 0.88, 1.00, and 0.97 consecutively for boosted decision tree on the applied data sets.

Web architecture for URL-based phishing detection based on Random Forest, Classification Trees, and Support Vector Machine

Nowadays phishing is as serious a problem as any other, but it has intensified a lot in the current coronavirus pandemic, a time when more than ever we all use the Internet even to make payments daily. In this context, tools have been developed to detect phishing, there are quite complex tools in a computational calculation, and they are not so easy to use for any user. Therefore, in this work, we propose a web architecture based on 3 machine learning models to predict whether a web address has phishing or not based mainly on Random Forest, Classification Trees, and Support Vector Machine. Therefore, 3 different models are developed with each of the indicated techniques and 2 models based on the models, which are applied to web addresses previously processed by a feature retrieval module. All this is deployed in an API that is consumed by a Frontend so that any user can use it and choose which type of model he/she wants to predict with. The results reveal that the best performing model when predicting both results is the Classification Trees model obtaining precision and accuracy of 80%.
 En la actualidad el phishing es un problema tan serio como cualquier otro, pero se ha intensificado bastante en la actual pandemia del coronavirus, un momento en el que más que nunca todos utilizamos internet hasta para realizar pagos cotidianamente. En este contexto se han desarrollado herramientas para detectar phishing, existen herramientas bastante complejas en calculo computacional y que no son de tan sencilla utilización para cualquier usuario. Por ende, en este trabajo proponemos una arquitectura web basada en 3 modelos de aprendizaje automático para predecir si una dirección web tiene phishing o no basados principalmente en Random Forest, Classification Trees y Support Vector Machine. Por lo tanto, se desarrollan 3 modelos distintos con cada una de las técnicas indicadas y 2 modelos basados en los anteriormente mencionados modelos, los cuales son aplicados a direcciones web previamente procesadas por un módulo de obtención de características. Todo ello se despliega en un API la cual es consumida por un Frontend para que cualquier usuario lo pueda utilizar y escoger con qué tipo de modelo quiere predecir. Los resultados revelan que el modelo que mejor se comporta al momento de predecir ambos resultados es el modelo de Árboles de clasificación obteniendo una precisión y exactitud de 80%.

Phishing Detection on Ethereum via Attributed Ego-Graph Embedding

In recent years, the losses caused by phishing scams on Ethereum have reached a level that cannot be ignored. In such a phishing detection scenario, network embedding is seen as an effective solution. In this brief, we propose an attributed ego-graph embedding framework to distinguish phishing accounts. We first obtain the account labels from an authority site and the transaction records from Ethereum on-chain blocks. Then we extract ego-graphs for each labeled account to represent it. To learn representations for ego-graphs, we utilize non-linear substructures sampled from ego-graphs and use a skip-gram model. Finally, a classifier is applied to graph embeddings to predict phishing accounts. To overcome the limit that transaction attributes are not encoded into ego-graph embeddings, we give nodes and subgraphs with richer attribute-based semantics. Specifically, we propose a novel node relabeling strategy based on Ethereum transaction attributes including transaction amount, number, and direction, and differentiating nodes and subgraphs by new labels. Through this, structural and attributed features of the Ethereum transaction networks can be learned at the same time. Experimental results show that our framework achieves effective performance on class imbalanced phishing detection on Ethereum.

A Non-Content Multilayers Hybrid Machine Learning Web Phishing Detection Model

Phishing detection is one of the most important services for cyber security. Phishing is an easy to implement attack that depends on social engineering. It is implemented leveraging web, Short Message Service (SMS) and social media. This attack is the backbone of other attacks. In this work, a new web phishing detection algorithm is proposed based on machine learning algorithms. The proposed algorithm is a hybrid machine learning algorithm that consists of two main layers. The first layer is the feature extraction and reduction layer that consists of multiple machine learning algorithms that work in parallel. The second layer consists of one feed-forward neural network layer. Different numbers and types of algorithms can be leveraged in the first layer of the proposed algorithm. The proposed model has been tested with four algorithms in the first layer, namely, K-means, support vector machine, logistic regression and random forest. Four features have been extracted from this layer and fed into the second layer “the neural network layer”. The output of the second layer shows an accuracy that exceeded 99%.

Review on Phishing Attack Detection using Recurrent Neural Network

Phishing is a crime that involves the theft of personal information from users. Individuals, corporations, cloud storage, and government websites are all targets for the phishing websites. Anti-phishing technologies based on hardware are commonly utilised, while software-based options are preferred due to cost and operational considerations. Current phishing detection systems have no solution for problems like zero-day phishing assaults. To address these issues, a three-phase attack detection system called the Phishing Attack Detector based on Web Crawler was suggested, which uses a recurrent neural network to precisely detect phishing incidents. Based on the classification of phishing and non-phishing pages, it covers the input features Web traffic, web content, and Uniform Resource Locator (URL).