Semantic Feature Selection for Text with Application to Phishing Email Detection

Verma, Rakesh M.; Hossain, Nabil

doi:10.1007/978-3-319-12160-4_27

Cited by 23 publications

(18 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The best phishing emails are hard to detect and tend to avoid detection measures, and smart attackers send these emails to people who are easy targets (e.g., non IT people). In the literature [16,11,14,7,9,13,15], nobody could detect 100% of phishing emails, this shows the limit of the current automatic detection systems. Hence, it is better to include the user either in the detection process, or at least by just sending him a warning to make him pay more attention [10,5].…”

Section: Hypothesismentioning

confidence: 99%

Comprehensive Method for Detecting Phishing EmailsUsing Correlation-based Analysis and User Participation

Verma

Aassal²

2017

Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy

Self Cite

View full text Add to dashboard Cite

Phishing email has become a popular solution among attackers to steal all kinds of data from people and easily breach organizations' security system. Hackers use multiple techniques and tricks to raise the chances of success of their attacks, like using information found on social networking websites to tailor their emails to the target's interests, or targeting employees of an organization who probably can't spot a phishing email or malicious websites and avoid sending emails to IT people or employees from Security department. In this paper we focus on analyzing the coherence of information contained in the different parts of the email: Header, Body, and URLs. After analyzing multiple phishing emails we discovered that there is always incoherence between these different parts. We created a comprehensive method which uses a set of rules that correlates the information collected from analyzing the header, body and URLs of the email and can even include the user in the detection process. We take into account that there is no such thing called perfection, so even if an email is classified as legitimate, our system will still send a warning to the user if the email is suspicious enough. This way even if a phishing email manages to escape our system, the user can still be protected.

show abstract

Section: Hypothesismentioning

confidence: 99%

Comprehensive Method for Detecting Phishing EmailsUsing Correlation-based Analysis and User Participation

Verma

Aassal²

2017

Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy

Self Cite

View full text Add to dashboard Cite

show abstract

“…This work differs from theirs in several respects: we consider many other classifiers than they do and we analyze more lexical features, including the character distributions of the URLs. More on phishing email detection can be found in [24,23].…”

Section: Related Researchmentioning

confidence: 99%

On the Character of Phishing URLs

Verma

Dyer

2015

Proceedings of the 5th ACM Conference on Data and Application Security and Privacy

Self Cite

View full text Add to dashboard Cite

Phishing attacks resulted in an estimated $3.2 billion dollars worth of stolen property in 2007, and the success rate for phishing attacks is increasing each year [17]. Phishing attacks are becoming harder to detect and more elusive by using short time windows to launch attacks. In order to combat the increasing effectiveness of phishing attacks, we propose that combining statistical analysis of website URLs with machine learning techniques will give a more accurate classification of phishing URLs. Using a two-sample Kolmogorov-Smirnov test along with other features we were able to accurately classify 99.3% of our dataset, with a false positive rate of less than 0.4%. Thus, accuracy of phishing URL classification can be greatly increased through the use of these statistical measures.

show abstract

“…We notice from this table that most authors use relatively balanced ratios (e.g., 4 to 6 or 4.5 to 5.5). Examples of research in the literature that used unbalanced datasets with different ratios are [161], [165], [167], [169], [175].…”

Section: Dataset Properties 1) Dataset Sources and Availabilitymentioning

confidence: 99%

“…A few papers also leverage semantics to increase the robustness of the features and increase the performance of classifiers. The following papers [161], [162], [171], [190], [192] reported the use of WordNet 26 to enrich the textual features. Wordnet is a large lexical dataset for English and is used to identify the semantic relationships of the tokens used as features.…”

Section: F Selected Email Detection Literaturementioning

confidence: 99%

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

Self Cite

View full text Add to dashboard Cite

Phishing and spear phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and baserate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear phishing and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.

show abstract

Semantic Feature Selection for Text with Application to Phishing Email Detection

Cited by 23 publications

References 19 publications

Comprehensive Method for Detecting Phishing EmailsUsing Correlation-based Analysis and User Participation

Comprehensive Method for Detecting Phishing EmailsUsing Correlation-based Analysis and User Participation

On the Character of Phishing URLs

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Contact Info

Product

Resources

About