Classification of Anti-phishing Solutions

Abstract

Phishing is an online fraud through which phisher gains unauthorized access to the user system to lure the personal credentials (such as username, password, credit/debit card number, validity, CVV number, and pin) for financial gain. Phishing can be carried out in many ways: through emails, phone calls, instant messages, advertisements, and popups on the website and poisoning the DNS. To protect the users from phishing, many anti-phishing toolbars/extensions had been developed. These anti-phishing tools prevent the Internet users not to fall a victim of phishing scams. No anti-phishing approach can give 100 % security. In this paper, we present a complete classification of an anti-phishing solution in algorithmic perspective. The taxonomy helps in understanding various anti-phishing approaches and algorithms developed for phishing detection. Popular anti-phishing toolbars are taken to show the media they address, mode of operation, and their pros and cons. It also provides further research gap that has to be addressed.

Phishing Attacks: A Recent Comprehensive Study and a New Anatomy

“…A range of solutions are being discussed and proposed by the researchers to overcome the problems of phishing, but still, there is no single solution that can be trusted or capable of mitigating these attacks (Hong, 2012;Boddy, 2018;Chanti and Chithralekha, 2020). The proposed phishing countermeasures in the literature can be categorized into three major defense strategies.…”

“…Furthermore, some security experts claim that user education is not effective as security is not the main goal for users and users do not have a motivation to educate themselves about phishing (Scaife et al, 2016), while others confirm that user education could be effective if designed properly (Evers, 2006;Whitman and Mattord, 2012). Moreover, user training has been mentioned by many researchers as an effective way to protect users when they are using online services (Dodge et al, 2007;Salem et al, 2010;Chanti and Chithralekha, 2020). To detect and avoid phishing emails, a combined training approach was proposed by authors in the study (Salem et al, 2010).…”

“…Content-based methods classify the page or the email relying on the information within its content such as texts, images, and also HTML, java scripts, and Cascading Style Sheets (CSS) codes (Zhang et al, 2007;Maurer and Herzner, 2012). Content-based solutions involve Machine Learning (ML), heuristics, visual similarity, and image processing methods (Miyamoto et al, 2009;Chanti and Chithralekha, 2020). and finally, multifaceted methods, which apply a combination of the previous approaches to detect and prevent phishing attacks (Afroz and Greenstadt, 2009).…”

“…3. Corrective techniques that can take down the compromised website, by requesting the website's Internet Service Provider (ISP) to shut down the fake website in order to prevent more users from falling victims to phishing (Moore and Clayton, 2007;Chanti and Chithralekha, 2020). ISPs are responsible for taking down fake websites.…”

E-mail-Based Phishing Attack Taxonomy

“…Another solution to eliminate the duplication of values in various categories is the usage of the graph structure. Graph structure for taxonomy presentation is used by Chanti and Chithralekha [9] in the taxonomy of anti-phishing solutions. Graph structure allows the authors to define which solutions of content-based phishing solutions are associated with rule-based solutions.…”