Search

Phishing is a fraud attempt in which an attacker acts as a trusted person or entity to obtain sensitive information from an internet user. In this Systematic Literature Survey (SLR), different phishing detection approaches, namely Lists Based, Visual Similarity, Heuristic, Machine Learning, and Deep Learning based techniques, are studied and compared. For this purpose, several algorithms, data sets, and techniques for phishing website detection are revealed with the proposed research questions. A systematic Literature survey was conducted on 80 scientific papers published in the last five years in research journals, conferences, leading workshops, the thesis of researchers, book chapters, and from high-rank websites. The work carried out in this study is an update in the previous systematic literature surveys with more focus on the latest trends in phishing detection techniques. This study enhances readers' understanding of different types of phishing website detection techniques, the data sets used, and the comparative performance of algorithms used. Machine Learning techniques have been applied the most, i.e., 57 as per studies, according to the SLR. In addition, the survey revealed that while gathering the data sets, researchers primarily accessed two sources: 53 studies accessed the PhishTank website (53 for the phishing data set) and 29 studies used Alexa's website for downloading legitimate data sets. Also, as per the literature survey, most studies used Machine Learning techniques; 31 used Random Forest Classifier. Finally, as per different studies, Convolution Neural Network (CNN) achieved the highest Accuracy, 99.98%, for detecting phishing websites. [ABSTRACT FROM AUTHOR]

Hackers are increasingly launching phishing attacks via SMS and social media. Games and dating apps introduce yet another attack vector. However, current deep learning-based phishing detection applications are not applicable to mobile devices due to the computational burden. We propose a lightweight phishing detection algorithm that distinguishes phishing from legitimate websites solely from URLs to be used in mobile devices. As a baseline performance, we apply Artificial Neural Networks (ANNs) to URL-based and HTML-based website features. A model search results in 15 ANN models with accuracies >96%, comparable to state-of-the-art approaches. Next, we test the performance of deep ANNs on URL-based features only; however, all models perform poorly with the highest accuracy of 86.2%, indicating that URL-based features alone are not adequate to detect phishing websites even with deep ANNs. Since language transformers learn to represent context-dependent text sequences, we hypothesize that they will be able to learn directly from the text in URLs to distinguish between legitimate and malicious websites. We apply two state-of-the-art deep transformers (BERT and ELECTRA) for phishing detection. Testing custom and standard vocabularies, we find that pre-trained transformers available for immediate use (with fine-tuning) outperform the model trained with the custom URL-based vocabulary. Using pre-trained transformers to predict phishing websites from only URLs has four advantages: 1) requires little training time (~8 minutes), 2) is more easily updatable than feature-based approaches because no pre-processing of URLs is required, 3) is safer to use because phishing websites can be predicted without physically visiting the malicious sites and 4) is easily deployable for real-time detection and is applicable to run on mobile devices. [ABSTRACT FROM AUTHOR]

Stacked Generalization has been assessed and evaluated in the field of Phishing URLs detection. This field has become egregious area of information security. Recently, different phishing URLs detection systems have already proposed by several researchers. But due to the lack of proper machine learning algorithm selection, the performance of those systems can be affected. A details investigation on individual machine learning classifiers on level 1 and final prediction from level 2 along with three real datasets have been presented on this paper. The performance has been evaluated by precision-recall curve, AUC-ROC curve, accuracy, misclassification rate and mean absolute error (MAE). The best AUC area obtained from Random Forest and Multi Layer Perceptron (MLP) individually. But stacked generalization provides higher accuracy of 97.44% with numeric feature set in binary classification and in multiclass feature set (dataset three), provides the performance with 97.86% of accuracy. Stacked generalization provides minimum error rate and MAE of 2.142857% with multiclass feature set which leads to a strong basement of developing an anti-phishing tools. [ABSTRACT FROM AUTHOR]

Phishing websites distribute unsolicited content and are frequently used to commit email and internet fraud. Detecting them before any user information is submitted is critical. Several efforts have been made to detect these phishing websites in recent years. Most existing approaches use hand-crafted lexical and statistical features from a website's textual content to train classification models to detect phishing web pages. However, these phishing detection approaches have limitations, including (1) the tediousness of extracting hand-crafted features, which require specialized domain knowledge to determine which features are useful for a particular platform; and (2) the difficulties encountered by models built on hand-crafted features to capture the semantic patterns in words and characters in URL and HTML content. To address these challenges, this paper proposes WebPhish, an end-to-end deep neural network trained using embedded raw URLs and HTML content to detect website phishing attacks. First, the proposed model automatically employs an embedding technique to extract the corresponding characters into homologous dense vectors. Then, the concatenation layer merges the URL and HTML embedding matrices. Following that, Convolutional layers are used to model its semantic dependencies. Extensive experiments were conducted with real-world phishing data, which yielded an accuracy of 98.1%, showing that WebPhish outperforms baseline detection approaches in identifying phishing pages. • WebPhish employs both raw URL and HTML content to detect phishing web pages. • WebPhish uses character-level embeddings to enable the feature vectors to generalize to new data. • Extensive experiments conducted on a real-world dataset yields 98.1% accuracy. • Its application on the airline Twitter dataset shows the proposed model's flexibility. [ABSTRACT FROM AUTHOR]

Security threats are becoming very sophisticated and pervasive everywhere. Phishing threats in particular has a changeable nature and short life cycle that complicates the detection process. In this paper, we introduce a Multi-Agent System (MAS) as an adaptive intelligent technique that acts on top of distributed Case-Based Reasoning (CBR) Phishing Detection Systems (CBR-PDSs) as a Phishing Detection System Architecture (PDSA) that runs on large scale globally to constitute a robust worldwide Phishing Threat Intelligence (PTI) environment. The global collaborations of PTI introduces a proactive phishing detection technique, quarantines phishing threats via global threats sharing, and minimizes users’ susceptibilities to hard-to-detect spear or advanced phishing attacks. Also, combining two intelligent systems in a unified interactive architecture facilitates the prediction process, increases the accuracy rate, easily tackles the dynamic and changeable behaviors of advanced phishing threats, and minimizes the false negative rate as well. The proposed architecture illustrates the consolidated interaction between intelligent agents and distributed CBR-PDSs in a PTI framework. [ABSTRACT FROM AUTHOR]

Abstract: Many classifications techniques have been used and devised to combat phishing threats, but none of them is able to efficiently identify web phishing attacks due to the continuous change and the short life cycle of phishing websites. In this paper, we introduce a Case-Based Reasoning (CBR) Phishing Detection System (CBR-PDS). It mainly depends on CBR methodology as a core part. The proposed system is highly adaptive and dynamic as it can easily adapt to detect new phishing attacks with a relatively small data set in contrast to other classifiers that need to be heavily trained in advance. We test our system using different scenarios on a balanced 572 phishing and legitimate URLs. Experiments show that the CBR-PDS system accuracy exceeds 95.62%, yet it significantly enhances the classification accuracy with a small set of features and limited data sets. [ABSTRACT FROM AUTHOR]

In recent years, phishing attacks have evolved considerably, causing existing adversarial features that were widely utilised for detecting phishing websites to become less discriminative. These developments have fuelled growing interests among security researchers towards an anti-phishing strategy known as the identity-based detection technique. Identity-based detection techniques have consistently achieved high true positive rates in a rapidly changing phishing landscape, owing to its capitalisation on fundamental brand identity relations that are inherent in most legitimate webpages. However, existing identity-based techniques often suffer higher false positive rates due to complexities and challenges in establishing the webpage's brand identity. To close the existing performance gap, this paper proposes a new hybrid identity-based phishing detection technique that leverages webpage visual and textual identity. Extending earlier anti-phishing work based on the website logo as visual identity, our method incorporates novel image features that mimic human vision to enhance the logo detection accuracy. The proposed hybrid technique integrates the visual identity with a textual identity, namely, brand-specific keywords derived from the webpage content using textual analysis methods. We empirically demonstrated on multiple benchmark datasets that this joint visual-textual identity detection approach significantly improves phishing detection performance with an overall accuracy of 98.6%. Benchmarking results against an existing technique showed comparable true positive rates and a reduction of up to 3.4% in false positive rates, thus affirming our objective of reducing the misclassification of legitimate webpages without sacrificing the phishing detection performance. The proposed hybrid identity-based technique is proven to be a significant and practical contribution that will enrich the anti-phishing community with improved defence strategies against rapidly evolving phishing schemes. • Remain sustainable against evolving phishing threats by using identity-based method. • Achieve reduced false positives thus improving practicality of proposed solution. • Leverage hybrid identities to attain robustness across diverse range of websites. • Exploit novel image features based on human vision to enhance website logo detection. • Enrich website visual analysis via active browser rendering and DOM manipulation. [ABSTRACT FROM AUTHOR]

In view of semantic counterfeiting characteristics of phishing websites and their multi-scale composition, this paper fully considers the semantic information of different scales, and proposes three semantic-based phishing detection models at different depths using various deep learning methods. The proposed three models are Multi-scale Data-layer Fusion (MDF) model, Multi-scale Feature-layer Fusion (MFF) model and Multi-scale In-depth Fusion(MIF) model. Experimental results on a constructed complex dataset show that the three models all have good recognition capabilities and the MIF model achieves the best performance on a complex dataset, with an F1-Measure of 0.9830, AUC value of 0.9993 and a false positive rate of 0.0047. Then with further comparison with both visual and text methods and an active discovery experiment lasting for 6 months with 3016 phishing websites detected in the real network environment, it is found that the proposed model is both competitive and practical for real detection scenarios. • Semantic information at different scales is mined and fused at different depths. • Three semantic-based deep phishing detection models are proposed. • Various comparative experiments are carried out and prove the effectiveness. • A phishing discovery experiment in reality detected 3016 phishing websites. [ABSTRACT FROM AUTHOR]

Phishing attacks are one of the most challenging social engineering cyberattacks due to the large amount of entities involved in online transactions and services. In these attacks, criminals deceive users to hijack their credentials or sensitive data through a login form which replicates the original website and submits the data to a malicious server. Many anti-phishing techniques have been developed in recent years, using different resource such as the URL and HTML code from legitimate index websites and phishing ones. These techniques have some limitations when predicting legitimate login websites, since, usually, no login forms are present in the legitimate class used for training the proposed model. Hence, in this work we present a methodology for phishing website detection in real scenarios, which uses URL, HTML, and web technology features. Since there is not any updated and multipurpose dataset for this task, we crafted the Phishing Index Login Websites Dataset (PILWD), an offline phishing dataset composed of 134,000 verified samples, that offers to researchers a wide variety of data to test and compare their approaches. Since approximately three-quarters of collected phishing samples request the introduction of credentials, we decided to crawl legitimate login websites to match the phishing standpoint. The developed approach is independent of third party services and the method relies on a new set of features used for the very first time in this problem, some of them extracted from the web technologies used by the on each specific website. Experimental results show that phishing websites can be detected with 97.95% accuracy using a LightGBM classifier and the complete set of the 54 features selected, when it was evaluated on PILWD dataset. • Using legitimate homepage websites foster false positives during login classification. • Proposed web technology features improve phishing detection accuracy. • Legitimate login websites ensure generalization in practical scenarios. • PILWD-134K: A publicly available dataset for phishing detection benchmarking. [ABSTRACT FROM AUTHOR]

As a new intrusion method in the security field, phishing poses an enormous threat to network security and personal privacy. Thus, improving the level of network security and preventing phishing are a matter of great concern to both the state and researchers. A 2 (automation trust tendency) *2 (system reliability level) *2 (feedback) between-subjects design was adopted to study the impact of individual characteristics and system features on phishing detection. Three hundred ninety-eight participants completed a phishing email task to identify whether 40 emails were legitimate or fraudulent. The results showed that systems with feedback and high reliability improve users' performance in email identification. Users with a high tendency towards automation trust have a higher risk of phishing. However, feedback from the system helps calibrate a high automation trust tendency. These research results can promote an understanding of phishing prevention mechanisms and provide support for the design of email defence systems. [ABSTRACT FROM AUTHOR]

• Detecting spear-phishing email attacks based on sender domains. • Figuring out that the domain's sender is genuine or forgery. • Providing a balanced trade-off between detecting targeted attacks and bypassing the genuine emails. The latest report by Kaspersky on email Spam and targeted Phishing attacks, by percentage, highlights the need of an urgent solution. Attachment-driven Spear-phishing struggles to succeed against many email providers' malware-filtration systems, which proactively check emails for malicious software. In this paper, we provided a solution that can detect targeted Spear-phishing attacks based on required similarities in the specific domain which it has been targeted. The strategy is to figure out whether the domain is genuine or a forgery, which is to be evaluated by multi novel grading algorithms. Therefore, this research addresses targeted attacks on specific organisations by presenting a new enterprise solution. This detection system focuses on domain names, which tend to be registered domain names trusted by the victims. The results from this investigation show that this detection system has proven its ability to reduce email phishing attacks significantly. [Display omitted] [ABSTRACT FROM AUTHOR]

• Define three types of features extracted from URLs, domains, etc. • Exploit a method to balance the majority and minority class samples. • Adopt an improved DAE-based method to reduce the dimension of the dataset. • Boost the detection performance by using the improved ELM-based classifier. • Do experiments to verify the feasibility and effectiveness of the proposed approach. In this paper, a novel approach based on non-inverse matrix online sequence extreme learning machine (NIOSELM) for phishing detection is presented, which takes into account three types of features to comprehensively characterize a website. For the NIOSELM algorithm, we use Sherman Morriso Woodbury equation to avoid the matrix inversion operation, and introduce the idea of online sequence extreme learning machine (OSELM) to update the training model. In order to reduce the dependence of the detection model on the majority class, we use Adaptive Synthetic Sampling (ADASYN) algorithm to generate the synthetic minority class samples to balance the distribution between the samples of the majority and minority classes. Furthermore, an improved denoising auto-encoder (SDAE) is designed to reduce the dimension of the experimental dataset. The experimental results show the efficiency and feasibility of the proposed detection mechanism. Moreover, the overall detection performance of NIOSELM is better than that of other existing methods, especially in training speed and the detection accuracy. [ABSTRACT FROM AUTHOR]

Recently, phishing emerges as one of the biggest threats to human's daily networking environments. Phishing attackers disguise illegal URLs as normal ones to steal user's private information with the social engineering techniques, such as emails and SMS, which calls for an effective method of preventing phishing attacks to relieve the loss by them. Neural networks can be used to detect and prevent phishing attacks because of their strong active learning abilities from massive datasets and high accuracy in data classification. However, duplicate points in the public datasets and negative and useless features in the feature vectors will trap the training of the neural networks into the problem of over-fitting, which will make the trained classifier weak when detect phishing websites. This paper proposes DTOF-ANN (Decision Tree and Optimal Features based Artificial Neural Network) to tackle this shortcoming, which is a neural-network phishing detection model based on decision tree and optimal feature selection. First, the traditional K-medoids clustering algorithm is improved with an incremental selection of initial centers to remove the duplicate points from the public datasets. Then, an optimal feature selection algorithm based on the new defined feature evaluation index, decision tree and local search method is designed to prune out the negative and useless features. Finally, the optimal structure of the neural network classifier is constructed through properly adjusting parameters and trained by the selected optimal features. Experimental results have demonstrated that DTOF-ANN exhibits higher performance than many of the existing methods. • Improves the K-medoids clustering algorithm. • Defines a new index (f_Value) for evaluating the phishing features. • Designs an optimal feature selection algorithm. [ABSTRACT FROM AUTHOR]