A survey and classification of web phishing detection schemes

Varshney, Gaurav; Misra, Manoj; Atrey, Pradeep K.

doi:10.1002/sec.1674

Cited by 113 publications

(61 citation statements)

References 61 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Classroom based discussions and training [33] and web-based ant-phishing training materials from organisations such as eBay, Microsoft, etc [38] are some of the methods used to impart anti-phishing training to the user. Recently, Hanna Alghamdi [6] developed a phishing quiz mobile application to check the phishing detection ability of the user and to assess efficacy of online anti-phishing educational materials.…”

Section: Introductionmentioning

confidence: 99%

Building Confidence not to be Phished Through a Gamified Approach: Conceptualising User's Self-Efficacy in Phishing Threat Avoidance Behaviour

Baral

Arachchilage

2019

2019 Cybersecurity and Cyberforensics Conference (CCC)

View full text Add to dashboard Cite

Phishing attacks are prevalent and humans are central to this online identity theft attack, which aims to steal victims' sensitive and personal information such as username, password, and online banking details. There are many anti-phishing tools developed to thwart against phishing attacks. Since humans are the weakest link in phishing, it is important to educate them to detect and avoid phishing at-tacks. One can argue self-efficacy is one of the most important determinants of individual's motivation in phishing threat avoidance behavior, which has co-relation with knowledge. The proposed research endeavors on the user's self-efficacy in order to enhance the individual's phishing threat avoidance behavior through their motivation. Using social cognitive theory, we explored that various knowledge attributes such as observational (vicarious) knowledge, heuristic knowledge and structural knowledge contributes immensely towards the individual's self-efficacy to enhance phishing threat prevention behavior. A theoretical framework is then developed depicting the mechanism that links knowledge attributes, self-efficacy, threat avoidance motivation that leads to users' threat avoidance behavior. Finally, a gaming prototype is designed incooperating the knowledge elements identified in this research that aimed to enhance individual's self-efficacy in phishing threat avoidance behavior.

show abstract

Section: Introductionmentioning

confidence: 99%

Building Confidence not to be Phished Through a Gamified Approach: Conceptualising User's Self-Efficacy in Phishing Threat Avoidance Behaviour

Baral

Arachchilage

2019

2019 Cybersecurity and Cyberforensics Conference (CCC)

View full text Add to dashboard Cite

show abstract

“…As another methodology, heuristics based approaches rely on the use of features revealed from text, image or URLspecific information from legitimate and phishing websites [6]. In general, these features are then utilized by use of machine learning algorithms to form a set of heuristics for further classification of phishing websites.…”

Section: Introductionmentioning

confidence: 99%

Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

Dalgic

Bozkır

Aydos

2018

2018 2nd International Symposium on Multidisciplinary Studies and Innovative Technologies (ISMSIT)

View full text Add to dashboard Cite

Phishing, a continuously growing cyber threat, aims to obtain innocent users' credentials by deceiving them via presenting fake web pages which mimic their legitimate targets. To date, various attempts have been carried out in order to detect phishing pages. In this study, we treat the problem of phishing web page identification as an image classification task and propose a machine learning augmented pure vision based approach which extracts and classifies compact visual features from web page screenshots. For this purpose, we employed several MPEG7 and MPEG7-like compact visual descriptors (SCD, CLD, CEDD, FCTH and JCD) to reveal color and edge based discriminative visual cues. Throughout the feature extraction process we have followed two different schemas working on either whole screenshots in a "holistic" manner or equal sized "patches" constructing a coarse-to-fine "pyramidal" representation. Moreover, for the task of image classification, we have built SVM and Random Forest based machine learning models. In order to assess the performance and generalization capability of the proposed approach, we have collected a mid-sized corpus covering 14 distinct brands and involving 2852 samples. According to the conducted experiments, our approach reaches up to 90.5% F1 score via SCD. As a result, compared to other studies, the suggested approach presents a lightweight schema serving competitive accuracy and superior feature extraction and inferring speed that enables it to be used as a browser plugin.

show abstract

“…Websites. Three teams of researchers have surveyed phishing website detection [32], [274], [275]. In [274], phishing website detection papers were studied along five dimensions: blacklist/whitelist, instantaneous protection, decision support tools, community rating tools such as Web of Trust, and intelligent heuristics, for the first time.…”

Section: Related Workmentioning

confidence: 99%

“…In [274], phishing website detection papers were studied along five dimensions: blacklist/whitelist, instantaneous protection, decision support tools, community rating tools such as Web of Trust, and intelligent heuristics, for the first time. Subsequently, Varshney et al [275] added search-based, visual-similarity, DNS-based, and proactive phishing URL based techniques. They also discussed pros and cons for each type of detection technique and some selected papers, for which they summarized results and dataset sizes.…”

Section: Related Workmentioning

confidence: 99%

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Das

Baki

Aassal

et al. 2020

IEEE Commun. Surv. Tutorials

108

View full text Add to dashboard Cite

Phishing and spear phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and baserate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear phishing and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.

show abstract

A survey and classification of web phishing detection schemes

Cited by 113 publications

References 61 publications

Building Confidence not to be Phished Through a Gamified Approach: Conceptualising User's Self-Efficacy in Phishing Threat Avoidance Behaviour

Building Confidence not to be Phished Through a Gamified Approach: Conceptualising User's Self-Efficacy in Phishing Threat Avoidance Behaviour

Phish-IRIS: A New Approach for Vision Based Brand Prediction of Phishing Web Pages via Compact Visual Descriptors

SoK: A Comprehensive Reexamination of Phishing Research From the Security Perspective

Contact Info

Product

Resources

About