Multilayer hybrid strategy for phishing email zero‐day filtering

Abstract

Summary The cyber security threats from phishing emails have been growing buoyed by the capacity of their distributors to fine‐tune their trickery and defeat previously known filtering techniques. The detection of novel phishing emails that had not appeared previously, also known as zero‐day phishing emails, remains a particular challenge. This paper proposes a multilayer hybrid strategy (MHS) for zero‐day filtering of phishing emails that appear during a separate time span by using training data collected previously during another time span. This strategy creates a large ensemble of classifiers and then applies a novel method for pruning the ensemble. The majority of known pruning algorithms belong to the following three categories: ranking based, clustering based, and optimization‐based pruning. This paper introduces and investigates a multilayer hybrid pruning. Its application in MHS combines all three approaches in one scheme: ranking, clustering, and optimization. Furthermore, we carry out thorough empirical study of the performance of the MHS for the filtering of phishing emails. Our empirical study compares the performance of MHS strategy with other machine learning classifiers. The results of our empirical study demonstrate that MHS achieved the best outcomes and multilayer hybrid pruning performed better than other pruning techniques. Copyright © 2016 John Wiley & Sons, Ltd.

Text Mining in Big Data Analytics

“…A phishing attack that uses sophisticated techniques that direct online customers to a new web page that has not yet been included in the black-list is called a zero-day attack [131]. Chowdhury et al [132] in their overview of the work on the filtering of phishing emails and pruning techniques, proposed a multilayer hybrid strategy (MHS) for the zero-day filtering of phishing emails that emerge during a separate time span, which uses the training data collected previously during another time span. MHS was based on a new pruning method, the multilayer hybrid pruning (MHP).…”

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

“…Misspelled/Bad domain name 8 U [36], [42], [43], [56], [69], [72], [80], [89] Top Level Domain features 22 U,W,E [36], [38], [43], [46], [65], [69], [70], [78], [85], uW: [105], [107], [110], [113], [138], [139], [152], [154], [157], uE: [163], [170], [182], [194] TTL c value of DNS 9 U,W,E [28], [43], [47], [70], uW: [93], [102], [132], [144], uE: [186] Age of Domain 13 U,W,E [52], uW: [107], [113], [119], [120], [124], [125], [127], [132], [150],…”

Towards a Multi-Layered Phishing Detection

“…An empirical study by [46] used a layered process to strengthen an ensemble of classifiers by pruning, a technique to remove minor contributions to classification. Despite efforts to enhance the pruning process and achieving a higher F-measure compared to other non-pruned techniques, the dataset in use was very small.…”