Applying Clustering and Ensemble Clustering Approaches to phishing Profiling

Yearwood, J., Webb, D., Ma, Li, Vamplew, P., Ofoghi, B. and Kelarev, A.

Each clustering is motivated by a natural representation of the emails. A data set of 2048 phishing emails provided by a major Australian financial institution was pre-processed to extract features describing the textual content, hyperlinks and orthographic structure of the emails. Independent clusterings using different techniques were performed on each representation, and these clusterings were then ensembled using a variety of consensus functions. This paper concentrates on using several clustering approaches to determine the most likely number of phishing groups and explores ways in which individual and combined results relate. The approach suggests a number of phishing groups and the structure of the approach can aid the development of profiles based on the individual clusters. The actual profiling is not carried out in this paper.

Cite as: Yearwood, J., Webb, D., Ma, Li, Vamplew, P., Ofoghi, B. and Kelarev, A. (2009). Applying Clustering and Ensemble Clustering Approaches to phishing Profiling. In Proc. Australasian Data Mining Conference (AusDM'09) Melbourne, Australia. CRPIT, 101. Kennedy P. J., Ong K. and Christen P. Eds., ACS. 25-34

(from crpit.com) (local if available)