Fuzzy Rough Set Feature Selection to Enhance Phishing Attack Detection

Abstract

Phishing as one of the most well-known cybercrime activities is a deception of online users to steal their personal or confidential information by impersonating a legitimate website. Several machine learning-based strategies have been proposed to detect phishing websites. These techniques are dependent on the features extracted from the website samples. However, few studies have actually considered efficient feature selection for detecting phishing attacks. In this work, we investigate an agreement on the definitive features which should be used in phishing detection. We apply Fuzzy Rough Set (FRS) theory as a tool to select most effective features from three benchmarked data sets. The selected features are fed into three often used classifiers for phishing detection. To evaluate the FRS feature selection in developing a generalizable phishing detection, the classifiers are trained by a separate out-of-sample data set of 14,000 website samples. The maximum F-measure gained by FRS feature selection is 95% using Random Forest classification. Also, there are 9 universal features selected by FRS over all the three data sets. The F-measure value using this universal feature set is approximately 93% which is a comparable result in contrast to the FRS performance. Since the universal feature set contains no features from third-part services, this finding implies that with no inquiry from external sources, we can gain a faster phishing detection which is also robust toward zero-day attacks.

Phishing Web Page Detection Using Optimised Machine Learning

“…There are URL feature-based approaches [5] which look at items that are suspicious in the URL such as potential emails in a URL, number of sub domains, or the length of the URL. Page rank features [4] are another set of features that are used, this will be features which look at how search engines view the page, and if it appears on the front page or not. Alexa page rank is another popular feature in this area.…”

“…Percentage of links that do not lead to another page (link leads to "" or "#") [8] Percentage of links that lead to an external page. [4] Page rank Domain of page appears on the front page of Google (true/false) [4] Page information…”

“…Certificate issuer [9] Certificate duration [4] Hash of page appears on googles safe browsing blacklist…”

“…URL contains "http" after the protocol (true/false) URL contains an IP address (true/false)[4] Domain contains "www" (true/false) Domain contains common file extensions (css, php, html) (true/false for each) URL contains certain key words (e.g. log, pay) (true/false for each)[7] URL contains a certain TLD (top level domain) (true/false for each) DOM structure…”

A New Solution to Protect Encryption Keys when Encrypting Database at the Application Level

“…Currently, a penetration to a DB using SQL injection techniques becomes fast and quite simple thanks to specialized tools [10]. Different threats may come from various sources, some from trusted DB users, others from external ones, and some attacks are performed by the DB administrators [1], [2], [3]. Data theft is a dangerous attack.…”