A survey on anti-phishing techniques: From conventional methods to machine learning

Abstract

Phishing is a deceptive technique to steal confidential information like user credentials and bank account details of web users. Employing technical and social engineering skills phishers make huge financial loss to web users and large organizations alike, and it has become one of the serious cybercrime today. This paper discusses different types of phishing techniques, their impacts, common indicators of phishing attacks, and analyses various anti-phishing solutions from conventional methods implementing blacklist, white list, heuristics, fuzzy logic, visual similarity, etc. to machine learning methods. The study provides gap analysis of conventional anti-phishing techniques, and points out the challenges facing machine learning based approaches including proper feature selection, diversity in data sets, imbalanced scenarios, and differences in evaluation metrics. This investigation outlines the need for serious researches in this area since there is no foolproof solution to phishing as phishers change their tactics very often to bypass anti-phishing detection systems.