Learning to Detect Phishing Emails

Abstract

There are an increasing number of emails purporting to be from a trusted entity that attempt to deceive users into providing account or identity information, commonly known as "phishing" emails. Traditional spam filters are not adequately detecting these undesirable emails, and this causes problems for both consumers and businesses wishing to do business online. From a learning perspective, this is a challenging problem. At first glance, the problem appears to be a simple text classification problem, but the classification is confounded by the fact that the class of "phishing" emails is nearly identical to the class of real emails. We propose a new method for detecting these malicious emails called PILFER. By incorporating features specifically designed to highlight the deceptive methods used to fool users, we are able to accurately classify over 92% of phishing emails, while maintaining a false positive rate on the order of 0.1%. These results are obtained on a dataset of approximately 860 phishing emails and 6950 non-phishing emails. The accuracy of PILFER on this dataset is significantly better than that of SpamAssassin, a widely-used spam filter.

Investigating Information Structure of Phishing Emails Based on Persuasive Communication Perspective

“…Phishing variables are selected from reviewing phishing related literature (Drake et al, 2005;Fett et al, 2006) For different analysis, different set of data was used. For factor analysis, five different phishing emails were shown to coders.…”

“…Consequently, some studies identified phishing specific features and systems were designed accordingly. Some of the phishing specific features are IP-based URLs, age of domain names, non-matching URLs, number of links, number of domains, number of dots, and use of javascript (Drake, Oliver, & Koontz, 2005;Fett, Sadeh, & Tomasic, 2006). However, it can be argued that easily discernable features in text, in the same sense, can be easily manipulated by sophisticated attackers.…”

Intelligent phishing detection system for e-banking using fuzzy data mining

“…Thus high accuracy from the data mining algorithms cannot be expected. However, the evidence supporting the golden nuggets comes from a number different algorithms and feature sets and we believe it is compelling [26].…”

Towards misdirected email detection for preventing information leakage

“…Most commercial products works on the network level, where an email is inspected and a policy is applied. Various featurebased solutions [5], [6], [7], [8], [9] have been proposed to address the classical issues in email security, such as spam detection, phishing detection and email spoofing detection. The solutions base on term features that are extracted from email contents or sender features that describe the email sender's information.…”