Profiling Phishing Email Based on Clustering Approach

Hamid, Isredza Rahmi A.; Abawajy, Jemal

doi:10.1109/trustcom.2013.76

Cited by 16 publications

(24 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We notice from this table that most authors use relatively balanced ratios (e.g., 4 to 6 or 4.5 to 5.5). Examples of research in the literature that used unbalanced datasets with different ratios are [161], [165], [167], [169], [175].…”

Section: Dataset Properties 1) Dataset Sources and Availabilitymentioning

confidence: 99%

“…However, the ratios used are still not realistic. We cite for example [167], where the authors used a dataset made of 4,150 legitimate and 2,687 phishing emails from SpamAssassin and Nazario respectively. Masoumeh et al [166] relied on the same sources but used different ratios: 1,700 ham and 1,000 phishing emails.…”

Section: F Selected Email Detection Literaturementioning

confidence: 99%

“…Frequency of Tokens 12 U,W [28], [35], [36], [38], [45], [46], [52], [65], [66], [80], [81], uW: [94] Longest Token 6 U [35], [36], [44], [45], [66], [ [34], [35], [76], [80], [85], uW: [127], [132] Port presence 18 U,W,E [36], [38], [40], [49], [58], [67], [70] uW: [96], [126], [144], [152], [154], [158], uE: [167], [168], [170], [178], [180] HTTPS or HTTP 15 U,W [38], [54], [65], uW: [96], [98], [102], [105],…”

Section: Dns Basedmentioning

confidence: 99%

“…1 [162] "Subject" features (length of the subject, # of words, # of characters, vocabulary richness, etc.) 8 [164], [166], [173], [178], [185] [167], [170], [189] Blacklisted words in "Subject" 4 [168]- [170], [178] # of words and/or characters in the "Send" field 1 [167] "Sender" domain "Reply-to" domain 4 [167], [168], [170], [178] "Sender" domain "Message-Id" domain 1 [169] "Sender" / "From" email's modal domains 5 [165], [167], [170], [178], [180] Timestamp, "Sent date" 3 [163], [164], [173] Source IP, Autonomous System Number, Origin Country 1 [173] "Subject": Fwd, Reply 3 [167], [168], [170] Interaction habits 1 [163] "Cc", "BCc" fields 1 [164] "X-Mailer", "X-Originating-IP", "X-Originating-hostname", "X-spam-flag',"X-virus-scanned' 1 [164] Body Lexical Features (# of words, # of unique words, # of characters, Tokens a , regular expressions, etc.) 12…”

mentioning

confidence: 99%

See 3 more Smart Citations

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

102

View full text Add to dashboard Cite

Phishing and spear phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and baserate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear phishing and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.

show abstract

Section: Dataset Properties 1) Dataset Sources and Availabilitymentioning

confidence: 99%

Section: F Selected Email Detection Literaturementioning

confidence: 99%

Section: Dns Basedmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

102

View full text Add to dashboard Cite

show abstract

“…Antiphishing is of great significance for network security and financial security. The phishing detection can be based on emails [2][3] [4], domains and URLs [5], authentication and passwords [6][7] [8], and Web pages. In this paper, only the Web pages based anti-phishing methods are discussed.…”

Section: Introductionmentioning

confidence: 99%

Visual Similarity Based Anti-phishing with the Combination of Local and Global Features

Zhou

Zhang

Xiao

et al. 2014

2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications

View full text Add to dashboard Cite

Phishing uses a fake Web page to steal personal sensitive information such as credit card numbers and passwords. Generally, the fake Web page is visually similar to the legitimate target Web page. The phishers can obtain financial benefits through these information. Anti-phishing is very important for a variety of applications such as phishing attacks, online transaction security, and user privacy protection.In this paper, we propose a novel and effective visual similarity based phishing detection approach that compares the snapshot image pair of the suspected Web page and the protected Web page. The proposed approach is based on the key insight that both the local and the global features of the Web page image can be used to represent the visual characteristics of the Web page together. This approach is purely on the image level, and thus can effectively deal with the non-text phishing tricks including images or Flashes objects in the HTML contents. For the local feature, the existence of the target logo is detected. For the global feature, the similarity of the visible part of the Web page is considered. We implemented and evaluated the proposed approach on a large scale dataset consisting of 2,129 real world phishing Web pages and 1,367 irrelevant legitimate Web pages. The experimental results show that the proposed approach can achieve over 90.00% true positive rate and 97.00% true negative rate. Our approach has been applied in the anti-phishing project of a major Internet Service Provider and gives a periodical reports to the potential users.

show abstract

Dynamic Trackback Strategy for Email-Born Phishing Using Maximum Dependency Algorithm (MDA)

Hamid

Samsudin

Arbaiy

2016

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

Profiling Phishing Email Based on Clustering Approach

Cited by 16 publications

References 12 publications

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Visual Similarity Based Anti-phishing with the Combination of Local and Global Features

Dynamic Trackback Strategy for Email-Born Phishing Using Maximum Dependency Algorithm (MDA)

Contact Info

Product

Resources

About