Detecting Phishing Emails the Natural Language Way

Abstract

Phishing causes billions of dollars in damage every year and poses a serious threat to the Internet economy. Email is still the most commonly used medium to launch phishing attacks [1]. In this paper, we present a comprehensive natural language based scheme to detect phishing emails using features that are invariant and fundamentally characterize phishing. Our scheme utilizes all the information present in an email, namely, the header, the links and the text in the body. Although it is obvious that a phishing email is designed to elicit an action from the intended victim, none of the existing detection schemes use this fact to identify phishing emails. Our detection protocol is designed specifically to distinguish between "actionable" and "informational" emails. To this end, we incorporate natural language techniques in phishing detection. We also utilize contextual information, when available, to detect phishing: we study the problem of phishing detection within the contextual confines of the user's email box and demonstrate that context plays an important role in detection. To the best of our knowledge, this is the first scheme that utilizes natural language techniques and contextual information to detect phishing. We show that our scheme outperforms existing phishing detection schemes. Finally, our protocol detects phishing at the email level rather than detecting masqueraded websites. This is crucial to prevent the victim from clicking any harmful links in the email. Our implementation called PhishNet-NLP, operates between a user's mail transfer agent (MTA) and mail user agent (MUA) and processes each arriving email for phishing attacks even before reaching the inbox.

User experiences of TORPEDO: TOoltip-poweRed Phishing Email DetectiOn

“…Other checks can also be carried out. For example, to look at differences between displayed and actual domain names [13] or carry out an NLP analysis of the actual email text [38]. If the email is delivered and the person clicks, post-click detection can also occur.…”

On the Character of Phishing URLs

“…This work differs from theirs in several respects: we consider many other classifiers than they do and we analyze more lexical features, including the character distributions of the URLs. More on phishing email detection can be found in [24,23].…”

What's in a URL

“…Previous researchers [14,27] have considered URL classification based on link analysis only by proposing systems which use search engine based features as well as web site popularity and blacklists as major attributes for URL detection. However, with search engines rate-limiting queries and charging for them, methods based on Web search are becoming infeasible.…”

“…However, with search engines rate-limiting queries and charging for them, methods based on Web search are becoming infeasible. There have been some phishing URL detection attempts in the past using special symbols [20], domain information [27,29], or single-character distributions [26], but few have investigated character N-grams as features for phishing URL detection. Moreover, mostly batch machine learning algorithms have been used for phishing URL classification and analysis.…”