There are many applications available for phishing detection. However, unlike predicting spam, there are only few studies that compare machine learning techniques in predicting phishing. The present study compares the predictive accuracy of several machine learning methods including Logistic Regression (LR), Classification and Regression Trees (CART), Bayesian Additive Regression Trees (BART), Support Vector Machines (SVM), Random Forests (RF), and Neural Networks (NNet) for predicting phishing emails. A data set of 2889 phishing and legitimate emails is used in the comparative study. In addition, 43 features are used to train and test the classifiers.

No abstract

ABSTRACT

One of the solutions that has been widely used by naive users to protect against phishing attacks is security toolbars or phishing filters in web browsers. The present study proposes a new attack to bypass security toolbars and phishing filters via local DNS poisoning without the need of an infection vector. A rogue wireless access point (AP) is set up, poisoned DNS cache entries are used to forge the results provided to security toolbars, and thus misleading information is displayed to the victim. Although there are several studies that demonstrate DNS poisoning attacks, none to our best knowledge investigate whether such attacks can circumvent security toolbars or phishing filters. Five well‐known security toolbars and three reputable browser built‐in phishing filters are scrutinized, and none of them detect the attack. So ineptly, security toolbars provide the victim with false confirmative indicators that the phishing site is legitimate. Copyright © 2009 John Wiley & Sons, Ltd.

Abstract-Theimplementation of cyber threat countermeasures requires identification of points in a system where redundancy or other modifications are needed. Because large systems have many possible threats that may be interdependent, it is crucial that such threats be cataloged in a manner that allows for efficient representation and ease of analysis to identify the most critical threats. To address this problem, we model large system threats by conceptually representing them as a Cyber Threat Tree implemented as a directed graph known as a Multiple-Valued Decision Diagram (MDD). The cyber threat tree structure improves upon both the classical fault tree and attack tree structures by expanding the representation of possible system threats. This cyber threat tree model is incorporated into an existing MDD software package to help identify and catalog possible system threats. We have also developed a new formal language, CyTML, which is used to represent cyber threat trees.