Suspicious Email Research Articles

Like Shooting Phish in a Barrel: Cue Utilization and Cognitive Reflection Aid Performance in Controlled, but Not Naturalistic Phishing Tasks

The study tested the role of cue utilization and cognitive reflection tendencies in email users’ phishing decision capabilities in both controlled and naturalistic settings. 94 university students completed measures of their phishing cue utilization and cognitive reflection, a phishing decision task, and a naturalistic simulated phishing campaign, in which they were sent simulated phishing emails to their personal inboxes. For the phishing decision task, results revealed that participants with lower cognitive reflection tendencies were more likely to misclassify genuine emails as phishing, compared to participants with higher cognitive reflection. Further, participants with higher cognitive reflection and lower cue utilization took the most time to diagnose emails, but participants low in both cue utilization and cognitive reflection demonstrated the shortest response latencies. These findings suggest that greater cognitive reflection can offset lower levels of cue utilization. For the naturalistic simulation, neither cue utilization nor cognitive reflection predicted an increased propensity to interact with a suspicious email. This result highlights a potential gap between phishing investigations conducted in controlled and naturalistic settings. The implications extend to future research, emphasizing the need for studies that employ naturalistic methodologies to better understand and address phishing threats in real-world environments.

Being phished and reporting phishing emails: emotional and knowledge antecedents and training gaps

ABSTRACT Research on phishing, a prevalent cybercrime, has not addressed which dispositional and knowledge antecedents are related to reporting suspicious emails to their organizations and has provided limited attention to emotions as a predictor of being phished. Our prospective design involved two phases where employees and students at a university (N = 538) first completed a survey and then, after 1 month, were sent three phishing emails spaced weeks apart without their knowledge. Trained members were more likely to have knowledge about safe URLs and this accurate knowledge was associated with a lower rate of being phished and a higher rate of reporting phishing emails. Untrained members had a higher rate of clicking on links and a lower rate of reporting suspicious emails than recently trained members, though training efficacy dissipates over time. Members with high generalized anxiety were more likely to click on links and less likely to report phishing emails, suggesting a gap in training curriculum. High avoidant cognitive styles were less likely to report phishing emails, and these styles are more prevalent among those with high anxiety. Policies and training curriculum need to address anxiety to create a stronger defense against phishing and hacking attacks.

Bank Emails: The Language of Legit and Scam

Amidst the pandemic, the surge in unsolicited scam emails has made internet technology a significant concern. Distinguishing between scams and authentic/legit emails has become increasingly difficult. This research aimed to identify typical characteristics and language patterns found in emails. It also aimed to identify the common linguistics and technical features of the scams and legitimate bank emails. Two legitimate emails and two scam or fraudulent emails from different banks in the Philippines (i.e., LandBank and BDO). A qualitative method was used to analyze and interpret the language features of the two emails. This led to the identification of shared characteristics found in scams and legitimate emails. A scam email typically includes embedded malicious links, misspellings, formatting issues, suspicious email domains, frequent use of contractions and redundancy, tautology, and imperative mood. On the other hand, legitimate emails exhibit proper punctuation, accurate email domains, appropriate formatting, absence of spelling mistakes, avoidance of contractions and redundancy, and use indicative mood rather than imperative. Scam emails utilize modal verbs to manipulate recipients into divulging personal information. Recognizing these email patterns is crucial for educating users and reducing phishing risks. It is important to note that the interpretation and findings of this study are based on the entire dataset collected. Keywords: Bank Emails, Legit Emails, Linguistic Features, Scam Emails, Phishing

Framework for Mitigating Phishing E-mail in the Kenyan Banking Industry Using Artificial Intelligence (AI)

Purpose: Phishing is a significant cybercrime threat that affects individuals and organizations globally, including the banking industry in Kenya. The sophistication of phishing attacks continues to increase, and it is increasingly challenging traditional security measures to mitigate these threats. The purpose of this thesis is to build a framework for mitigating phishing e-mail attacks in the banking industry in Kenya using artificial intelligence. Phishing emails are among the most common techniques of cyber-attacks utilized by assailants to gain unauthorized access to sensitive information such as financial details, personal information, and login credentials. These attacks can have devastating effects on the victims, leading to financial loss, reputation damage, and even identity theft. Methodology: The framework development consists of four main stages: data collection, data preprocessing, model training, and deployment. In the data collection stage, a dataset of phishing and non-phishing emails is gathered from various sources such as public databases, dark web forums, and bank employees mail. In the data preprocessing stage, the collected data is cleaned, preprocessed, and labeled. In the model training stage, machine learning algorithms and NLP techniques is used to develop a robust phishing and non-phishing emails detection model. In the deployment stage, the model is integrated into the bank's email system to detect and block phishing emails in real-time. The framework is then evaluated using a dataset of phishing and non-phishing e-mails collected from the banking industry in Kenya. Various metrics such as accuracy, precision, recall, and F1-score are used to evaluate the framework. The framework is able to detect new phishing e-mails that were not previously included in the dataset, demonstrating its ability to adapt to new threats. Findings: The framework is based on a hybrid approach that combines machine learning algorithms, natural language processing (NLP) techniques, and human expertise that identify and prevent phishing emails from reaching their targets. The four main components of this framework include e-mail filtering, feature extraction, classification, and response. The e-mail filtering component uses several algorithms to identify and filter suspicious e-mails. The feature extraction component analyzes the content of the e-mail and extracts relevant features to help classify the e-mail as either legitimate or phishing. The classification component uses machine-learning algorithms to classify the e-mail as either legitimate or phishing. Finally, the response component takes appropriate action based on the classification results. Unique Contribution to Theory, Practice and Policy: The framework provides an effective way to identify and mitigate phishing e-mail attacks, reducing the risk of data breaches and financial losses.

Using anthropomorphism, transparency, and feedback to improve phishing detection aids

Phishing is a common cybersecurity threat to email users. An automated phishing decision-support aid can help users identify suspicious emails. The aid’s success depends on both the aid’s capability and the user’s trust in and usage of the aid. In this study, 465 participants were asked to judge phishing emails with an automated decision aid. We measured how users’ trust and decision making were affected by the type of aid (human, AI, text, no aid), gender (male, female), decision transparency (reasoning for aid’s decision present, absent), as well as feedback (present, absent). We found that an aid was helpful regardless of its anthropomorphic appearance (human vs. AI) and gender. Transparency was helpful with the human aid, but not the AI aid. Feedback effectively improved trust in all the aids, although it helped aid retention only for the text aid. Participants had overall positive comments about the aid and found it helpful. The findings can be applied to automated aid design to understand potential avenues for improving users’ trust, performance, and aid use.

IMPLEMENTATION OF DYNAMIC METHOD FOR MALWARE DETECTION IN EMAIL PHISHING ATTACKS ON LET'S DEFEND

In the rapidly evolving landscape of cybersecurity threats, the need for robust defenses against phishing attacks has become paramount. This study explores the efficacy of malware detection in phishing email attacks using dynamic analysis on the Letsdefend.io platform. Leveraging the insights provided by the Deloitte Center for Controllership regarding the escalating frequency of cyber adversaries targeting organizational data, this research investigates the effectiveness of the Letsdefend.io platform, particularly utilizing the SOC 146 rule, in identifying and mitigating phishing threats. Through a comprehensive analysis process encompassing dynamic malware analysis techniques, such as those employed by VirusTotal and URLHaus, alongside detailed examination of suspicious email attachments using the Mailbox feature, this study aims to provide insights into the evolving tactics of phishing attackers, specifically those utilizing Excel 4.0 Macros. The research methodology involves collecting malware samples for analysis, configuring sandbox environments with tools like Process Monitor and Regshot, and utilizing sophisticated analysis tools like ProcDot to visualize malware behavior. Additionally, the study examines the effectiveness of the Letsdefend.io platform in detecting phishing URLs and malicious domains reported by AnyRun and URLHaus databases. The findings reveal promising results in the detection and identification of phishing threats, shedding light on the potential of dynamic analysis methods in bolstering cybersecurity defenses against evolving phishing techniques. This research contributes to the ongoing efforts to enhance cybersecurity measures and protect organizational assets from the pervasive threat of phishing attacks.

Exploring Phishing Awareness and User Behavior: A Survey-based Investigation

Abstract: Phishing attacks remain a significant threat to internet users, exploiting vulnerabilities in human behaviour to deceive individuals into divulging sensitive information. Understanding user awareness of these attacks and their responses is crucial for developing an effective environment. This paper presents findings from a survey-based study aimed at assessing public awareness of phishing attacks and evaluating user responses. The survey explored participants' familiarity with phishing, knowledge levels, encounter frequencies, security practices, and responses to suspicious emails. Additionally, participants were queried about their experiences with phishing awareness training and their interest in receiving further education on the topic. The results provide insights into the current landscape of phishing awareness among internet users, highlighting areas of strength and vulnerability. These findings contribute to the ongoing efforts to enhance internet security and mitigate the risks posed by phishing attacks. The implications of the study's findings for cybersecurity education, awareness campaigns, and the development of anti-phishing tools are discussed.

Akademik Olmayan Bilim Adamlarının Hesaplarının Analizi Yoluyla Yıkıcı E-posta Yönetimi: Bilimsel Yayıncılıkta Uluslararası Zorluk

Scientific distant education and learning have become fast and straightforward in the internet era for information dissemination and sharing through e-publishing. However, this breakthrough has a severe drawback as misinformation and inaccurate scientific pieces of literature might be delivered to the audience. One of the most significant sources of this kind of flaw is the fraudulent publishing that is progressively growing. We aimed in this study to analyze predatory behavior communication through investigation of the e-mail account of a non-academic researcher. The study involved a text analysis of the identified different spam mail types. First, we have transformed e-mails that were considered spam into an Excel database. Then, categorization was executed to identify types of scientific fraud and their rate of delivery in the account during a definite time frame. Common keywords and country names were analyzed to spot the predatory markers. The study showed five categories of scientific predatory e-mails with a remarkable alarming rate of occurrence for invitations received for contribution to journal publishing. More than half of the received e-mails from these types involved country names embracing India, USA and UK. Among the screened 50 words/keywords from suspicious e-mails, only six of them contributed by 60% in frequency of occurrence. The spotting of patterns using text analysis coupled with Pareto charting would be helpful in e-mail management for researchers and scientists, especially non-academicians who do not have a frame of reference in scientific publishing and any qualified mentors or librarian available who could guide the publication process.

Spam Spoiler for Public and Private E-Mail Services

Abstract: In recent years, cyber security incidents have occurred frequently. In most of these incidents, attackers have used different types of spam email as a knock-on to successfully invade government systems, well-known companies, and websites of politicians and social organizations in many countries. The detection of spam mail from big email data has been paid public attention. However, the camouflage technology of spam mail is becoming more and more complex, and the existing detection methods are unable to confront the increasingly complex deception methods and the growing number of emails. In this project, we proposed to design a novel efficient approach named Spam Spoiler for big email data classification into four different classes: Normal, Fraudulent, Harassment, and Suspicious E-mails by using LSTM-based GRU. The new method includes two important stages, the sample expansion stage and the testing stage under sufficient samples. This project the LSTM-based GRU efficiently captures meaningful information from E-mails that can be used for forensic analysis as evidence. Experimental results revealed that Spam Spoiler performed better than existing ML algorithms and achieved a classification accuracy of 98% using the novel technique of LSTM with recurrent gradient units. As different types of topics are discussed in E-mail content analysis. Spam Spoiler effectively outperforms existing methods while keeping the classification process robust and reliable.

Falling for phishing attempts: An investigation of individual differences that are associated with behavior in a naturalistic phishing simulation

Social engineering cyber-attacks such as phishing emails pose a serious threat to the safety of many organizations. Given that the effectiveness of these attacks heavily relies on poor human decision making, an improved understanding of the individual characteristics that increase cybersecurity vulnerability could inform more targeted training. The current study aimed to identify whether several factors, including phishing email detection ability, confidence in one's phishing identification decisions, general attitudes towards one's level of responsibility and efficacy, and employee satisfaction and loyalty to the organization, may predict behavior in a naturalistic phishing simulation in an employment setting. We followed up employees of a large organization who had been recently targeted by a phishing simulation and asked them to complete a survey that included a phishing detection task. The employees’ behavior in the phishing simulation was ranked according to its safety: reporting the suspicious email, neither reporting nor clicking on the embedded link, and clicking on the link. We found that fewer years of employment at the organization and lower employee satisfaction and loyalty predicted increasingly unsafe behavior in the simulation. This suggests that newer and unsatisfied employees are most vulnerable to phishing attempts and might benefit most from targeted cybersecurity training.

A68 HOW REAL ARE YOUR SURVEY RESPONDENTS? IDENTIFYING FRAUDULENT RESPONDENTS IN ONLINE SURVEYS – A CASE EXAMPLE IN INFLAMMATORY BOWEL DISEASE (IBD)

Abstract Background Social media and online surveys are commonly used to recruit and collect data from patients and physicians about GI diseases – they are efficient, convenient, and less resource intensive compared to traditional recruitment approaches and paper surveys. However, online data fraud is increasing and difficult to identify. Online data fraud can include intentional duplicate responses/straight-lining/inattention, bots/malicious software, and professional survey takers who provide fraudulent responses to meet study eligibility. Purpose 1) Illustrate challenges of identifying fraudulent respondents through an algorithm and verification process we developed for our survey in IBD. 2) Demonstrate potential impact of fraudulent respondents on data and results. Method Online survey of Canadian adults (>18 years) with IBD about healthcare processes for managing IBD hosted using Qualtrics. Recruitment was done in clinic and online (mailing lists, social media). A $25 giftcard was offered for participation due to low response after 3 months in field, after which a large influx of ‘respondents’ occurred. Most were fraudulent although not obvious at first. To mitigate further fraudulent responses, we added the following to our survey: reCAPTCHA score, repeated question (year of IBD diagnosis), duplicate ID score, fraud score and honeypot question. Our algorithm to identify fraudulent responses included 13 binary ‘red flag’ variables: age <18 years, year of diagnosis < year of birth, 2 different year of diagnosis, invalid postal code, survey duration <10 minutes, survey duration 10-15 minutes, suspicious comments for open text questions (x2), duplicate email, suspicious email, duplicate ID score ≥30, fraud score ≥30, and failed honeypot question. These variables were used to generate a fraudulent response score (range: 0-13; 13=most likely fraudulent). ‘Respondents’ with scores >3 were categorized as likely fraudulent. Respondents with scores ≤3 were reviewed individually. Respondents flagged as likely real or unsure were emailed and asked to verify their age; those who correctly verified age were considered likely real and included in the final sample. Result(s) Of the 4334 ‘respondents’ who started the survey, based on fraudulent response score we identified 75% (n=3258) as likely fraudulent, 17% (n=727) as unsure and 8% (n=349) as likely real. After age verification, 76% (n=3297) were considered likely fraudulent, 14% (n=592) remained unsure, 10% (n=442) were considered likely real, and <1% (n=3) were duplicates of likely real respondents. Conclusion(s) Despite convenience, social media and online surveys can be prone to fraudulent responses, especially when incentives are offered. We developed an algorithm and verification process to identify fraudulent responses using an IBD survey example. Given that only 10% of the full sample was considered likely real, researchers using social media and online surveys should carefully examine data for fraudulent responses and apply strategies to mitigate risks. Please acknowledge all funding agencies by checking the applicable boxes below CCC Disclosure of Interest None Declared

Email-Based Cyberstalking Detection On Textual Data Using Multi-Model Soft Voting Technique Of Machine Learning Approach

ABSTRACT In the virtual world, many internet applications are used by a mass of people for several purposes. Internet applications are the basic needs of people in the modern days of lifestyle which are also making habitual society. Like social media, e-mail technology is also more prevalent among people of different categories for personal and official communications. The widespread use of e-mail-based communication is also raising various types of cybercrimes, including cyberstalking. Cyberstalkers also use an e-mail-based approach to harass the victim in the form of cyberstalking. Cyberstalkers utilize several content-wise and intent-wise approaches to target the victim, such as spamming, phishing, spoofing, malicious, defamatory, e-mail bombing, and non-spam e-mails, including sexism, racism, and threatening, and finally, trying to hack the account over e-mail technology. This paper proposed an EBCD model for automatic cyberstalking detection on textual data of e-mail using the multi-model soft voting technique of the machine learning approach. Initially, experimental works were performed to train, test, and validate all classifiers of three model sets on three different labeled datasets. Dataset D1 contains spam, fraudulent, and phishing e-mail subject, dataset D2 contains spam e-mail body text, while dataset D3 contains harassment-related data. After that, trained, tested, and validated classifiers of all model sets were applied as a combined approach to automatically classify the unlabeled e-mails from the user’s mailbox using the multi-model soft voting technique. The proposed EBCD model successfully classifies the e-mails from the user’s mailbox into cyberstalking e-mails, suspicious e-mails (spam and fraudulent), and normal e-mails. In each model set of the EBCD model, several classifiers, namely support vector machine, random forest, naïve bayes, logistic regression, and soft voting, were used. The final decision in classifying the e-mails from the user’s mailbox was taken by the soft voting technique of each model set. The TF-IDF feature extraction method was used with the entire applied machine learning model sets to obtain the feature vectors from the data. Experimental results show that the soft voting technique not only enhances the performance of the e-mail classification task but also supports making the right decision to avoid the wrong classification. Overall performance of the soft voting technique was better than other classifiers, although the performance of the support vector machine was also notable. As per experimental results, the soft voting technique obtained an accuracy of 97.7%, 97.7%, 98.9%, a precision of 97%, 98.3%, 98.6%, recall of 98.3%, 96.5%, 99.1%, f-score of 97.6%, 97.4%, 98.9%, and AUC of 99.4%, 99.7%, 99.9% on dataset D1, D2, and D3 respectively. The average performance of soft voting of each model set on classified e-mails from the user’s mailbox was also notable, with an accuracy of 96.3%, precision of 98.1%, recall of 94%, f-score of 95.9%, and AUC of 96.8%.

A cyber-risk framework for coordination of the prevention and preservation of behaviours1

Cybersecurity controls are deployed to manage risks posed by malicious behaviours or systems. What is not often considered or articulated is how cybersecurity controls may impact legitimate users (often those whose use of a managed system needs to be protected, and preserved). This oversight characterises the ‘blunt’ nature of many cybersecurity controls. Here we present a framework produced from consideration of concerns across methods from cybercrime opportunity reduction and behaviour change, and existing risk management guidelines. We illustrate the framework and its principles with a range of examples and potential applications, including management of suspicious emails in organizations, and social media controls. The framework describes a capacity to improve the precision of cybersecurity controls by examining shared determinants of negative and positive behaviours in a system. This identifies opportunities for risk owners to better protect legitimate users while simultaneously acting to prevent malicious activity in a managed system. We describe capabilities for a novel approach to managing sociotechnical cyber risk which can be integrated alongside elements of typical risk management processes. This includes consideration of user activities as a system asset to protect, and a consideration of how to engage with other stakeholders in the identification of behaviours to preserve in a system.

Phish Derby: Shoring the Human Shield Through Gamified Phishing Attacks

To better understand employees’ reporting behaviors in relation to phishing emails, we gamified the phishing security awareness training process by creating and conducting a month-long “Phish Derby” competition at a large university in the U.S. The university’s Information Security Office challenged employees to prove they could detect phishing emails as part of the simulated phishing program currently in place. Employees volunteered to compete for prizes during this special event and were instructed to report suspicious emails as potential phishing attacks. Prior to the beginning of the competition, we collected demographics and data related to the concepts central to two theoretical foundations: the Big Five personality traits and goal orientation theory. We found several notable relationships between demographic variables and Phish Derby performance, which was operationalized from the number of phishing attacks reported and employee report speed. Several key findings emerged, including past performance on simulated phishing campaigns positively predicted Phish Derby performance; older participants performed better than their younger colleagues, but more educated participants performed poorer; and individuals who used a mix of PCs and Macs at work performed worse than those using a single platform. We also found that two of the Big Five personality dimensions, extraversion and agreeableness, were both associated with poorer performance in phishing detection and reporting. Likewise, individuals who were driven to perform well in the Phish Derby because they desired to learn from the experience (i.e., learning goal orientation) performed at a lower level than those driven by other goals. Interestingly, self-reported levels of computer skill and the perceived ability to detect phishing messages failed to exhibit a significant relationship with Phish Derby performance. We discuss these findings and describe how focusing on motivating the good in employee cyber behaviors is a necessary yet too often overlooked component in organizations whose training cyber cultures are rooted in employee click rates alone.

A Review of Factors Affecting the Effectiveness of Phishing

Phishing has become the most convenient technique that hackers use nowadays to gain access to protected systems. This is because cybersecurity has evolved and low-cost systems with the least security investments will need quite advanced and sophisticated mechanisms to be able to penetrate technically. Systems currently are equipped with at least some level of security, imposed by security firms with a very high level of expertise in managing the common and well-known attacks. This decreases the possible technical attack surface. Nation-states or advanced persistent threats (APTs), organized crime, and black hats possess the finance and skills to penetrate many different systems. However, they are always in need of the most available computing resources, such as central processing unit (CPU) and random-access memory (RAM), so they normally hack and hook computers into a botnet. This may allow them to perform dangerous distributed denial of service (DDoS) attacks and perform brute force cracking algorithms, which are highly CPU intensive. They may also use the zombie or drone systems they have hacked to hide their location on the net and gain anonymity by bouncing off around them many times a minute. Phishing allows them to gain their stretch of compromised systems to increase their power. For a normal hacker without the money to invest in sophisticated techniques, exploiting the human factor, which is the weakest link to security, comes in handy. The possibility of successfully manipulating the human into releasing the security that they set up makes the life of the hacker very easy, because they do not have to try to break into the system with force, rather the owner will just open the door for them. The objective of the research is to review factors that enhance phishing and improve the probability of its success. We have discovered that hackers rely on triggering the emotional effects of their victims through their phishing attacks. We have applied the use of artificial intelligence to be able to detect the emotion associated with a phrase or sentence. Our model had a good accuracy which could be improved with the use of a larger dataset with more emotional sentiments for various phrases and sentences. Our technique may be used to check for emotional manipulation in suspicious emails to improve the confidence interval of suspected phishing emails.

An Incentive Mechanism for Reporting Phishing E-Mails Based on the Tripartite Evolutionary Game Model

The human is considered as the important link in the phishing attack, and the e-mail security provider encourages users to report suspicious e-mails. However, evidence suggests that reporting is scarce. Therefore, we study how to motivate users to report phishing e-mails in this paper. To solve the problem, a tripartite evolutionary game model among e-mail security providers, e-mail users, and attackers is constructed. We obtain the desired evolutionary stable strategy through solving the replicator dynamics equations. Moreover, the evolution process to the desired evolutionary stable strategy is derived, which can guide the e-mail security provider to make a reasonable incentive mechanism. Lastly, we experiment with a large real-world e-mail network. The experiment results show that our model is effective and practical.

THE PLACE OF SOCIAL ENGINEERING IN THE PROBLEM OF DATA LEAKS AND ORGANIZATIONAL ASPECTS OF CORPORATE ENVIRONMENT PROTECTION AGAINST FISHING E-MAIL ATTACKS

As the number and percentage of phishing attacks on company employees and regular users have tended to increase rapidly over the last two years, it is necessary to cover the issue of protection against this type of social engineering attacks. Throughout the pandemic, intruders are finding more and more new ways to cheat, so even experienced Internet users can become a victim to their scams. Due to the fact that e-mail is used in almost all companies, most fishing attacks use e-mail to send malicious messages. The article discusses the main methods used by attackers to conduct phishing attacks using e-mail, signs that the user has become a victim to social engineers, and provides recommendations how to increase the resilience of the corporate environment to such attacks using organizational methods. Because the user is the target of phishing attacks, and the tools built into the browser and email clients in most cases do not provide reliable protection against phishing, it is the user who poses the greatest danger to the company, because he, having become a victim of a fishing attack, can cause significant damage to the company due to his lack of competence and experience. That is why it is necessary to conduct training and periodic testing of personnel to provide resistance to targeted phishing attacks. Company employees should be familiar with the signs of phishing, examples of such attacks, the principles of working with corporate data and their responsibility. The company's management must create and communicate to the staff regulations and instructions that describe storage, processing, dissemination and transfer processes of information to third parties. Employees should also report suspicious emails, messages, calls, or people who have tried to find out valuable information to the company's security service. Raising general awareness through hands-on training will reduce the number of information security incidents caused by phishing attacks.

A million dodgy emails

In the two months following the launch of the Suspicious Email Reporting System by the National Cyber Security Centre (NCSC), more than a million reports have been filed.

Phishing Diagnosis: A Multi-Feature Decision Tree-based Method

Phishing is an electronically connected criminal activity in which the attacker steals the user’s personal information like username, countersign, internet banking account, credit/debit card number with the expiration date, password, pin, legitimacy, confidential patient record, CVV number, etc. to boon financially. Email-based phishing is the most common and traditional way of phishing scams, in which the phisher will send a suspicious email with an embedded URL and ask the user to click the URL. When the user clicks on the link, the link will be redirected to a spoofed site that looks the same to the original site to steal their credentials and displays some error message. Later the phishing uses those credentials for malicious purposes. To overcome these scams, many anti-phishing tools have developed. Among that the machine learning-based approaches can give a better result. This paper is an extensive study of the various machine learning-based anti-phishing approaches and their results that detect the phishing URL's from the URLs with URLs features. Six most important models of machine learning have been examined for the phishing detection problem. The Decision Tree-based method outperforms other methods.

Empirical analysis of weapons of influence, life domains, and demographic-targeting in modern spam: an age-comparative perspective

Spam has been increasingly used for malware distribution. This paper analyzed modern spam from an age-comparative perspective to (i) discover the extent to which psychological weapons of influence and life domains were represented in today’s spam emails and (ii) clarify variations in the use of these weapons and life domains by user demographics. Thirty five young and 32 older participants forwarded 18,605 emails from their spam folder to our study email account. A random set of 961 emails were submitted to qualitative content coding and quantitative statistical analysis. Reciprocation was the most prevalent weapon; financial, leisure, and independence the most prevalent life domains. Older adults received health and independence-related spam emails more frequently, while young adults received leisure and occupation-related spam emails more often. These age differences show a level of targeting by user demographics in current spam campaigns. This targeting shows the need for age-tailored demographic warnings highlighting the presence of influence and pretexting (life domains) for suspicious emails for improved response to cyber-attacks that could result from spam distribution. The insights from this study and the produced labeled dataset of spam messages can inform the development of the next generation of such solutions, especially those based on machine learning.