Identification and Detection of Phishing Emails Using Natural Language Processing Techniques

Abstract

Phishing refers to fraudulent social engineering techniques used to elicit sensitive information from unsuspecting victims. In this paper, our scheme is aimed at detecting phishing mails which do not contain any links but bank on the victim"s curiosity by luring them into replying with sensitive information. We exploit the common features among all such phishing emails such as nonmentioning of the victim"s name in the email, a mention of monetary incentive and a sentence inducing the recipient to reply. This textual analysis can be further combined with header analysis of the email so that a final combined evaluation on the basis of both these scores can be done. We have shown that this method is far better than the existing Phishing Email Detection techniques as this covers emails without links while the pre-existing methods were based on the presumption of link(s).

Classification of Anti-phishing Solutions

“…4. A consolidated features' list is given in Table 1 which includes the email, website, URL, and Social media features from various sources for phishing detection [2,3,5,10,12,23,25,35,36,38,42,48,49,58,59,63,66,68,74]. Different anti-phishing approaches use different algorithms to classify the phishing attacks from the legitimate ones.…”

Evaluating user vulnerabilities vs phisher skills in spear phishing

“…The success rate of spear phishing attacks is quite high because the information included in the email content exploits humans' emotional responses to fear, greed, sense of urgency, curiosity, trusted personal relationships and standard business correspondence (Kim, Shin, Kim, & Lee, 2011a). In this respect, urgency is a contributing factor in spear phishing users' vulnerability when they receive emails that require an urgent response as this may put the victims under unnecessary pressure preventing them from making rational decisions prior to responding to the email (Aggarwal, Kumar, & Sudarsan, 2014).…”

“…When users out of curiosity respond to 'false negative emails', which are emails from unknown senders that contain innocuous looking sentences such as those asking about the health of the recipient or just a simple "how are you? ", the actual attack is carried out without the victim being aware (Aggarwal, Kumar, & Sudarsan, 2014). Therefore, while human carelessness is a critical vulnerability factor in phishing attacks, little empirical research has studied behaviors associated with information carelessness and the ways that people exploit this vulnerability (Workman, 2008).…”

“…Subjective norms (trust, and financial benefit): Spear phishing emails could assume the form of 'greed' or a 'promise of financial benefits' to lure their victims to provide sensitive information like the potential to access a very large amount of money, stacked away in an account and requiring the victim's cooperation to transfer the money to a safe haven (Aggarwal, Kumar, & Sudarsan, 2014). Since, 'trust' is a typical personality trait of people who are deceived by targeted e-mails (Torii, Morinaga, Yoshioka, Terada, & Unno, 2014), phishers exploit these trusts to compromise targets (Huang, Tan, & Liu, 2009).…”

“…Vulnerabilities References ` Financial benefit/ desire for monetary gain (Aggarwal, Kumar, & Sudarsan, 2014;Bere et al, 2015;Sahu & Dubey, 2014;Vayansky & Kumar, 2018;Zhou, Zhang, Xiao, Wang, & Lin, W. 2014;Oliveira et al, 2017) Curiosity (Aggarwal, Kumar, & Sudarsan, 2014;Bere et al, 2015;Cho, Cam, & Oltramari, 2016;Fette, Sadeh, Tomasic, 2007;Wash & Cooper, 2018;O'Kane, Sezer, & Carlin, 2018) Carelessness (Aburrous et al, 2010;Bere et al, 2015;Chiew, Chang, & Tiong, 2015;Kearney & Kruger, 2013;Laszka, Lou, & Vorobeychik, 2016;Miyamoto, Hazeyama, & Kadobayashi, 2005;Nagalingam, Narayana Samy, Ahmad, Maarop, & Ibrahim, R. 2015;Parmar, 2012;Workman, 2008;Wright & Marett, 2010;Zhang, Ren, & Jiang, 2016;Zhou et al, 2014) Trust in the sender (Alseadoon, Othman, Foo, & Chan, 2013;Bere et al, 2015;Cho, Cam, & Oltramari, 2016;Harrison, Vishwanath, & Rao, 2016;Huang, Tan, & Liu, 2009;Ivaturi, & Janczewski, 2012;Komatsu, Takagi, & Takemura, 2013;Patel & Luo, 2007;Romanov, Semenov, Mazhelis, & Veijalainen, J. 2017;Vayansky & Kumar, 2018) Lack of awareness; ignorance (Bann, Singh, & Samsudin, 2015;Caputo et ...…”