Search

Phishing attacks have become the preferred vehicle to gather sensitive information as well as to deliver dangerous malware. So far, there is still no phishing detection system that can perfectly detect and progressively self adapt to differentiate between phishing and legitimate websites. This paper proposes the case-based reasoning Phishing detection system (CBR-PDS) that relies on previous cases to detect phishing attacks. CBR-PDS is highly adaptive and dynamic as it can adapt to detect new phishing attacks using rather a small dataset size in contrast to other machine learning techniques. CBR-PDS aims to improve the detection accuracy and the reliability of the results by identifying a set of discriminative features and discarding irrelevant features. CBR-PDS relies on a two stage hybrid procedure using Information gain and Genetic algorithms. The reduction of the data dimensionality amounts to an improved accuracy rate, yet it necessitates a reduced processing time. The CBR-PDS is tested using different scenarios on a various balanced datasets. The obtained performances clearly show the suitability of our proposed hybrid feature selection procedure as well as the efficiency of the proposed CBR-PDS system. The obtained accuracy rates exceed 95%. We also show that the integration of an Online Phishing Threats component into the CBR-PDS system improves further the accuracy rate. Finally, CRB-PDS performances are compared to those of several known competitive classifiers.

Security threats are becoming very sophisticated and pervasive everywhere. Phishing threats in particular has a changeable nature and short life cycle that complicates the detection process. In this paper, we introduce a Multi-Agent System (MAS) as an adaptive intelligent technique that acts on top of distributed Case-Based Reasoning (CBR) Phishing Detection Systems (CBR-PDSs) as a Phishing Detection System Architecture (PDSA) that runs on large scale globally to constitute a robust worldwide Phishing Threat Intelligence (PTI) environment. The global collaborations of PTI introduces a proactive phishing detection technique, quarantines phishing threats via global threats sharing, and minimizes users’ susceptibilities to hard-to-detect spear or advanced phishing attacks. Also, combining two intelligent systems in a unified interactive architecture facilitates the prediction process, increases the accuracy rate, easily tackles the dynamic and changeable behaviors of advanced phishing threats, and minimizes the false negative rate as well. The proposed architecture illustrates the consolidated interaction between intelligent agents and distributed CBR-PDSs in a PTI framework.

Many classifications techniques have been used and devised to combat phishing threats, but none of them is able to efficiently identify web phishing attacks due to the continuous change and the short life cycle of phishing websites. In this paper, we introduce a Case-Based Reasoning (CBR) Phishing Detection System (CBR-PDS). It mainly depends on CBR methodology as a core part. The proposed system is highly adaptive and dynamic as it can easily adapt to detect new phishing attacks with a relatively small data set in contrast to other classifiers that need to be heavily trained in advance. We test our system using different scenarios on a balanced 572 phishing and legitimate URLs. Experiments show that the CBR-PDS system accuracy exceeds 95.62%, yet it significantly enhances the classification accuracy with a small set of features and limited data sets.