No abstract

No abstract

No abstract

Spear Phishing is one of the most harmful cyber-attacks facing business and individuals worldwide. In recent years, considerable research has been conducted into the use of Machine Learning (ML) techniques to detect spear phishing emails. ML-based solutions may suffer from zero-day attacks-unseen attacks unaccounted for in the training data. As new attacks emerge, classifiers trained on older data are unable to detect these new variety of attacks resulting in increasingly inaccurate predictions. Spear Phishing detection also faces scalability challenges due to the growth of the required features which is proportional to the number of the senders within a receiver mailbox. This differs from traditional phishing attacks which typically perform only a binary classification between 'phishing' and 'benign' emails. Therefore, we devise a possible solution to these problems, named RAIDER: Reinforcement AIded Spear Phishing DEtectoR. A reinforcement-learning based feature evaluation system that can automatically find the optimum features for detecting different types of attacks. By leveraging a reward and penalty system, RAIDER allows for autonomous features selection. RAIDER also keeps the number of features to a minimum by selecting only the significant features to represent phishing emails and detect spear phishing attacks. After extensive evaluation of RAIDER over 11,000 emails and across 3 attack scenarios, our results suggest that using reinforcement learning to automatically identify the significant features could reduce the required features dimensions by 55% in comparison to existing ML-based systems. It also improves the accuracy of detecting spoofing attacks by 4% from 90% to 94%. In addition, RAIDER demonstrates reasonable detection accuracy even against sophisticated attack named "Known Sender" in which spear phishing emails greatly resemble those of the impersonated sender. By evaluating and updating the feature set, RAIDER is able to increase accuracy by close to 20% from 49% to 62% when detecting Known Sender attacks.

No abstract

No abstract

No abstract

No abstract