Experimental Case Studies for Investigating E-Banking Phishing Techniques and Attack Strategies

Abstract

Phishing is a form of electronic identity theft in which a combination of social engineering and web site spoofing techniques are used to trick a user into revealing confidential information with economic value. The problem of social engineering attack is that there is no single solution to eliminate it completely, since it deals largely with the human factor. This is why implementing empirical experiments is very crucial in order to study and to analyze all malicious and deceiving phishing website attack techniques and strategies. In this paper, three different kinds of phishing experiment case studies have been conducted to shed some light into social engineering attacks, such as phone phishing and phishing website attacks for designing effective countermeasures and analyzing the efficiency of performing security awareness about phishing threats. Results and reactions to our experiments show the importance of conducting phishing training awareness for all users and doubling our efforts in developing phishing prevention techniques. Results also suggest that traditional standard security phishing factor indicators are not always effective for detecting phishing websites, and alternative intelligent phishing detection approaches are needed.

Visualisation Model Based on Phishing Features

“…There are massive website features available for extraction such as URL length, URL IP address, domain name, web tra±c, page rank, su±x and pre¯x, the \@" symbol and many others (Aburrous et al, 2010). A smaller subset of these can be used to discriminate among phishy and legitimate websites according to a number of research studies, for example, Basnet et al (2008).…”

Data Analytics: Intelligent Anti-Phishing Techniques Based on Machine Learning

“…Aburrous et al [9] classified web features into six criteria. Using WEKA, [7] investigated rule induction methods to seek their applicability for categorizing websites based on phishing features in their earlier study by Aburrous et al in [9]. Many experiments with four classification algorithms (RIPPER, PART, PRISM, C4.5) were conducted.…”

“…Aburrous et al [9] passed is less than 0.5, and legitimate if the value is greater than 0.5. Results were compared to that of [7] on fuzzy techniques and found their technique was able to slightly enhance the phishing detection rate.…”

Phishing Detection: Analysis of Visual Similarity Based Approaches

“…A phishing scam has attracted the attention of both academicians and corporate researchers as it is a serious privacy and web security threat [23][24][25][26][27][28][29][30][31][32][33]. Phishing cannot be controlled by firewalls or any encryption software [34][35][36].…”