Fighting against phishing attacks: state of the art and future challenges

Gupta, Brij B.; Tewari, Aakanksha; Jain, Ankit Kumar; Agrawal, Dharma P.

doi:10.1007/s00521-016-2275-y

Cited by 202 publications

(130 citation statements)

References 52 publications

Supporting

Mentioning

122

Contrasting

Unclassified

Order By: Relevance

“…c (pvt.) [21] [38], [72] [22], [41] [38], [41] [72], [77] a Gmail directory [34] b Spam URLs from UAB Spam DataMine email messages [38] c Private SpamTrap system [72], collected using blacklists and crowd-sourcing [41], [77] [78] a MalwareDomainslist [35] and malwareurl [48] b Malware private sources [78] unbalanced, or almost balanced, 9 data. Systems in [43], [59], [73] used more malicious URLs than legitimate ones.…”

Section: ) Dataset Sources and Availability: Inmentioning

confidence: 99%

“…In this survey, features for phishing URL detection are covered, and different kinds of machine learning techniques are surveyed: batch, on-line, representation, and "other." Also, [271], [272] survey a few papers on phishing URL detection, and [9], [11], [273] discuss some of the issues and literature associated with phishing URL detection.…”

Section: Related Workmentioning

confidence: 99%

“…User studies. To the best of our knowledge, there is no comprehensive survey of user studies of phishing or spear phishing, although some surveys, e.g., [9], [11], [273], [277], discuss it as part of their taxonomy, training, or study of selected solutions. In [278], the authors survey a few papers on user studies.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

101

View full text Add to dashboard Cite

Phishing and spear phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and baserate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear phishing and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.

show abstract

Section: ) Dataset Sources and Availability: Inmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

101

View full text Add to dashboard Cite

show abstract

“…Phishing scams can be carried out using technical subterfuge and social engineering [6]. Social engineering strategies use "spoofed" emails to guide users to fraudulent websites.…”

Section: Phishing Attack Classificationmentioning

confidence: 99%

“…The list-based solutions contain either black-list or white-list. These list-based solutions match the given domain with the domains present in the black-list or white-list to take the appropriate decision [5,6]. The combination of technical experts and security software verify when a new domain needs to be added in this list.…”

Section: Introductionmentioning

confidence: 99%

A novel approach to protect against phishing attacks at client side using auto-updated white-list

Jain

Gupta

2016

EURASIP J. on Info. Security

Self Cite

142

View full text Add to dashboard Cite

Most of the anti-phishing solutions are having two major limitations; the first is the need of a fast access time for a real-time environment and the second is the need of high detection rate. Black-list-based solutions have the fast access time but they suffer from the low detection rate while other solutions like visual similarity and machine learning suffer from the fast access time. In this paper, we propose a novel approach to protect against phishing attacks using auto-updated white-list of legitimate sites accessed by the individual user. Our proposed approach has both fast access time and high detection rate. When users try to open a website which is not available in the white-list, the browser warns users not to disclose their sensitive information. Furthermore, our approach checks the legitimacy of a webpage using hyperlink features. For this, hyperlinks from the source code of a webpage are extracted and apply to the proposed phishing detection algorithm. Our experimental results show that the proposed approach is very effective for protecting against phishing attacks as it has 86.02 % true positive rate while less than 1.48 % false negative rate. Moreover, our proposed system is efficient to detect various other types of phishing attacks (i.e., Domain Name System (DNS) poisoning, embedded objects, zero-hour attack).

show abstract

A review of phishing attacks and countermeasures for internet of things‐based smart business applications in industry 4.0

Sadiq

Anwar

Butt

et al. 2021

Human Behav and Emerg Tech

View full text Add to dashboard Cite

Due to the advancement in industry 4.0, cybercrimes in internet‐based business applications are rapidly increasing. To encounter such attacks, the intruders use various tools and techniques such as Phishing, Malware, SQL Injection, Ransomware, Cross‐Site Scripting (XSS), Denial of Service (DoS), Session Hijacking, and Credential Reuse. Phishing is most commonly in practice in the current digital era. Phishing is a fraudulent attempt to obtain sensitive information from deceiving users. These types of cyber‐attacks are used to harm individuals or entire businesses depending on the targeted objective of the attacker. To combat these attacks, the research community provides various phishing detection techniques. In this article, we classify state‐of‐the‐art fishing detection techniques in five major categories, that are, (1) Data Mining, Deep Learning & Machine Learning‐Based Approach, (2) Search Engine‐Based Approach, (3) URL Scan‐Based Approach, (4) Blacklisting‐Whitelisting Approach, and (5) Visual Similarity‐Based Approach. Further, a comparative analysis is provided within each category concerning their strength and weaknesses. Moreover, the article provides phishing prevention best practices to the readers to avoid such attacks.

show abstract

Fighting against phishing attacks: state of the art and future challenges

Cited by 202 publications

References 52 publications

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

A novel approach to protect against phishing attacks at client side using auto-updated white-list

A review of phishing attacks and countermeasures for internet of things‐based smart business applications in industry 4.0

Contact Info

Product

Resources

About