Profiling phishing activity based on hyperlinks extracted from phishing emails

Yearwood, John; Mammadov, Musa; Webb, Dean

doi:10.1007/s13278-011-0031-y

Cited by 15 publications

(11 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the user is tricked because the link directs him/her to the website following the ampersand symbol, which is a phishing website. [13] [18] In the following format <userinfo>@<host>, the browser will link to the <host> site and ignore the <userinfo>. That is, it is checked if the syntax of the URL is 'http(s)://username.password@domain_name or http://www.sbi.account.com@example.net/ Prior to the ampersand symbol is the user information, and following the ampersand symbol is the domain name to retrieve a webpage.…”

Section: Country-code Validationmentioning

confidence: 99%

“…For Instancehttp://paypal-update.com sounds legitimate but it is phished URL, redirecting spoofed website but the genuine is https://paypal.com. [13] [18] Hexadecimal in URL: If an IP address is used as an alternative of the domain name in the URL, such as "http://125.94.5.140/phishi.html", users can be sure that someone is trying to steal their personal information. the IP address is also converted in hexadecimal code as shown in the following linkhttp://0x58.0xCC.0xCA.0x62/2/paypal.ca/index.html or in ASCII code to confuse the user and redirect to phishing site [18].…”

Section: Country-code Validationmentioning

confidence: 99%

See 1 more Smart Citation

Email Phishing: An Enhanced Classification Model to Detect Malicious URLs

Sankhwar

Pandey

Khan³

2019

ICST Transactions on Scalable Information Systems

View full text Add to dashboard Cite

Phishing is the process of enticing people into visiting fraudulent websites and persuading them to enter their personal information. Number in phishing email are spread with the aim of making web users believe that they are communicating with a trusted entity or organization. Phishing is deployed by the use of advanced and harmful tactics like malicious or phishing URLs. So, it becomes necessary to detect malicious or phishing URLs in the present scenario. Numerous antiphishing techniques are in vogue to discriminate fake and the authentic website but are not effective. This research, focuses on the relevant URLs features that discriminate between legitimate and malicious/phishing URLs. The impact of email phishing can be largely reduced by adopting an appropriate combination of all these features with classification techniques. Therefore, an Enhanced Malicious URLs Detection (EMUD) model is developed with machine learning techniques for better classification and accurate results.

show abstract

Section: Country-code Validationmentioning

confidence: 99%

Section: Country-code Validationmentioning

confidence: 99%

Email Phishing: An Enhanced Classification Model to Detect Malicious URLs

Sankhwar

Pandey

Khan³

2019

ICST Transactions on Scalable Information Systems

View full text Add to dashboard Cite

show abstract

“…These Heuristic are associated with Suspicious URL forms or patterns and symbols, The Characters such as "@" and more than one time "//" rarely appear in a URL. 23,24 The legitimate sites have one TLD so if URL containing more than one considered as phishing site. Phishing sites have very less life-time as get block listed.…”

Section: Suspicious Url Forms or Patternsmentioning

confidence: 99%

“…Fake Login form in a phishing page is a dangerous sign of loss money or sensitive information as listed in Table 1. 13,14,16,[23][24][25][26][27][28][29][30][31][32][33][34][35][36]…”

Section: Suspicious Url Forms or Patternsmentioning

confidence: 99%

An anti‐phishing enterprise environ model using feed‐forward backpropagation and Levenberg‐Marquardt method

Sankhwar

Pandey

Khan

et al. 2020

Security and Privacy

View full text Add to dashboard Cite

Phishing in an enterprise is serious issue rising in wide scale and complexity, as phishers use email phishing via obfuscated, malicious or phished URLs and continuously adapt or innovate their strategies to lure victims for identity theft for financial benefits. To gain victim's trust and confidence phishers have started using visceral factors and familiarity cues. Phishing is not always money centric; phisher defame the user's goodwill and character. Defamation in enterprise could be much more traumatic than being embarrassed at a social networking site. It is a challenging task to address this issue. It is evident through literature review that single phishing detection filter approaches are insufficient to detect phishing in enterprise environ. Therefore, a novel anti-phishing model for enterprise using artificial neural network is proposed. In addition, this model effectively identifies whether the phishing email is known phishing or unknown phishing to reduce the trust and familiarity-based email phishing enterprise environ. The feed-forward backpropagation and Levenberg-Marquart methods of ANN are adopted to enhance the URL classification process and with Fuzzy Inference System to get result with imprecise data of social features. The proposed model can accurately classify the known and unknown email phishing via URLs. K E Y W O R D S authentication, E-mail phishing, enterprise cyber threat, machine learning techniques, privacy models for communication systems communication security, security and privacy in mobile communication services, social engineering 1 INTRODUCTION In digital era, email phishing is a critical issue causing loss of finance during online transactions. At present, different anti-phishing approaches are being proposed to detect email phishing attacks. Despite the various developed anti-phishing approaches are profoundly incompetent to tackle the real-time hassles. In literature review, a group of researchers argued upon about URLs blacklisting, which are mostly used in industry or organizations but not well off to

show abstract

“…Both these filters have high misclassification rates. AbuNimeh et al [11] [23] obtained profiles of phishing activity by solving the problem using a multi-class classification problem utilizing features extracted from URLs in the emails. This study is closely related to Bergholz et al [16,17], in the sense that, we use topic model PLSA (as compared to CLTOM) for phishing detection.…”

Section: Server Side Filters and Classifiersmentioning

confidence: 99%

phishGILLNET—phishing detection methodology using probabilistic latent semantic analysis, AdaBoost, and co-training

Ramanathan

Wechsler

2012

EURASIP J. on Info. Security

View full text Add to dashboard Cite

Identity theft is one of the most profitable crimes committed by felons. In the cyber space, this is commonly achieved using phishing. We propose here robust server side methodology to detect phishing attacks, called phishGILLNET, which incorporates the power of natural language processing and machine learning techniques. phishGILLNET is a multi-layered approach to detect phishing attacks. The first layer (phishGILLNET1) employs Probabilistic Latent Semantic Analysis (PLSA) to build a topic model. The topic model handles synonym (multiple words with similar meaning), polysemy (words with multiple meanings), and other linguistic variations found in phishing. Intentional misspelled words found in phishing are handled using Levenshtein editing and Google APIs for correction. Based on term document frequency matrix as input PLSA finds phishing and non-phishing topics using tempered expectation maximization. The performance of phishGILLNET1 is evaluated using PLSA fold in technique and the classification is achieved using Fisher similarity. The second layer of phishGILLNET (phishGILLNET2) employs AdaBoost to build a robust classifier. Using probability distributions of the best PLSA topics as features the classifier is built using AdaBoost. The third layer (phishGILLNET3) further expands phishGILLNET2 by building a classifier from labeled and unlabeled examples by employing Co-Training. Experiments were conducted using one of the largest public corpus of email data containing 400,000 emails. Results show that phishGILLNET3 outperforms state of the art phishing detection methods and achieves F-measure of 100%. Moreover, phishGILLNET3 requires only a small percentage (10%) of data be annotated thus saving significant time, labor, and avoiding errors incurred in human annotation.

show abstract

Profiling phishing activity based on hyperlinks extracted from phishing emails

Cited by 15 publications

References 18 publications

Email Phishing: An Enhanced Classification Model to Detect Malicious URLs

Email Phishing: An Enhanced Classification Model to Detect Malicious URLs

An anti‐phishing enterprise environ model using feed‐forward backpropagation and Levenberg‐Marquardt method

phishGILLNET—phishing detection methodology using probabilistic latent semantic analysis, AdaBoost, and co-training

Contact Info

Product

Resources

About