Abstract
In the last few years, phishing scams have rapidly grown posing huge threat to global Internet security. Today, phishing attack is one of the most common and serious threats over Internet where cyber attackers try to steal user’s personal or financial credentials by using either malwares or social engineering. Detection of phishing attacks with high accuracy has always been an issue of great interest. Recent developments in phishing detection techniques have led to various new techniques, specially designed for phishing detection where accuracy is extremely important. Phishing problem is widely present as there are several ways to carry out such an attack, which implies that one solution is not adequate to address it. Two main issues are addressed in our paper. First, we discuss in detail phishing attacks, history of phishing attacks and motivation of attacker behind performing this attack. In addition, we also provide taxonomy of various types of phishing attacks. Second, we provide taxonomy of various solutions proposed in the literature to detect and defend from phishing attacks. In addition, we also discuss various issues and challenges faced in dealing with phishing attacks and spear phishing and how phishing is now targeting the emerging domain of IoT. We discuss various tools and datasets that are used by the researchers for the evaluation of their approaches. This provides better understanding of the problem, current solution space and future research scope to efficiently deal with such attacks.
Similar content being viewed by others
Explore related subjects
Discover the latest articles, news and stories from top researchers in related subjects.References
The Phishing Guide Understanding & Preventing Phishing Attacks By: Gunter Ollmann, Director of Security Strategy, IBM Internet Security Systems, 2007
Phishing: Cutting the Identity Theft Line Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com, 2005, Rachael Lininger and Russell Dean Vines
Anti-Phishing Working Group (APWG), “Phishing activity trends report—first quarter 2013. http://antiphishing.org/reports/apwgtrendsreportq12013.pdf, accessed September 2014
Aloul F (2010) The need for effective information security awareness. Int J Intell Comput Res 1(3):176–183
James L (2005) Phishing exposed. Syngress Publishing, Burlington
Anti-Phishing Working Group (APWG) (2014) Phishing activity trends report—first quarter 2014. http://antiphishing.org/reports/apwgtrendsreportq12014.pdf. Accessed Sept 2014
Anti-Phishing Working Group (APWG) (2014) Phishing activity trends report—fourth quarter 2013. http://antiphishing.org/reports/apwgtrendsreportq42013.pdf. Accessed Sept 2014
Anti-Phishing Working Group (APWG) (2014) Phishing activity trends report—second quarter 2013. http://antiphishing.org/reports/apwgtrendsreportq22013.pdf. Accessed Sept 2014
Anti-Phishing Working Group (APWG) (2014) Global Phishing Survey—second half 2013. http://antiphishing.org/reports/apwgglobalphishingreport2h2013.pdf. Accessed Sept 2014
IT Business Edge (2014) Spear phishing, targeted attacks and data breach trends. http://www.itbusinessedge.com/slideshows/spear-phishing-targeted-attacks-and-data-breach-trends-04.html. Accessed on Sept 2014
Pierluigi Paganini (2014) Phishing: a very dangerous cyber threat. http://resources.infosecinstitute.com/phishing-dangerous-cyber-threat/2012. Accessed on Sept 2014
Krebs B (2014) HBGary federal hacked by anonymous. http://krebsonsecurity.com/2011/02/hbgary-federal-hacked-by-anonymous/2011. Accessed Sept 2014
eCrime Trends Report: Fourth Quarter (2013) http://Internetidentity.com/resource-tags/quarterly-ecrime-reports/. Accessed Sept 2014
Anti-Phishing Working Group (APWG) (2016) Phishing activity trends report—first-third quarter 2015. http://antiphishing.org/reports/apwgtrendsreportq12013.pdf. Accessed Feb 2016
Husna H, Phithakkitnukoon S, Palla S, Dantu R (2008) Behavior analysis of spam botnets. In: Communication systems software and middleware and workshops, 2008. COMSWARE 2008. 3rd International Conference, Bangalore, India, 2008, pp 246–253
Toolan F, Carthy J (2009) Phishing detection using classifier ensembles. In: eCrime researchers summit, IEEE conference Tacoma, WA, USA, 2009, pp 1–9
Toolan F, Carthy J (2010) Feature selection for spam and phishing detection. E-Crime Researchers Summit, Dallas, pp 1–12
Anti-Phishing Working Group Phishing Archive (2014) http://anti-phishing.org/phishing_archive.htm. Accessed Sept 2014
Dhamija R, Tygar JD (2005) The battle against phishing: dynamic security skins. Proceedings of symposium usable privacy and security
Aburrous M, Hossain MA, Dahal K, Thabtah F (2010) Predicting phishing websites using classification mining techniques with experimental case studies. In: Seventh international conference on information technology. IEEE Conference, Las Vegas, Nevada, USA, 2010, pp 176–181
PhishTank Phishing Archive (2014) http://www.phishtank.com/phisharchive.php. Accessed Sept 2014
Apache Software Foundation (2014) Spamassassin public corpus, 2006. http://spamassassin.apache.org/publiccorpus/. Accessed Sept 2014
Fette I, Sadeh N, Tomasic A (2007) Learning to detect phishing emails, In: Proceedings of 16th international world wide web conference (WWW 2007). ACM Press, Banff, Alberta, Canada, pp 649–656
Khonji M, Iraqi Y (2011) Lexical URL analysis for discriminating phishing and legitimate email. 6th IEEE international conference on internet technology and secure transaction, London, UK, pp 422–427
Cohen WW (2014) Enron email dataset. https://www.cs.cmu.edu/~./enron/. Accessed Sept 2014
“The Enron Spam Datasets” (2014) AEUB natural language processing group, Athens, Greece. http://www.aueb.gr/users/ion/data/enron-spam/. Accessed Sept 2014
Klimt B, Yang Y (2004) The enron corpus: a new dataset for email classification research. In: Proceedings of 15th European conference on machine learning, Nancy, France, 2004, pp 217–226
Georgala K, Kosmopoulous A, Paliouras G (2014) Spam filtering: an active learning approach using incremental clustering. In: Proceedings of ACM 4th international conference on web intelligence, mining and semantics, article no. 23, Greece, ACM
Cormack GV, Lynam TR (2005) TREC 2005 spam track overview. In: TREC
IronPort Anti-Spam (2014) http://www.ironport.com/technology/ironport/antispam.html. Accessed Sept 2014
Moore T, Clayton R, Stern H (2009) Temporal correlations between spam and phishing websites. In: Proceedings of 2nd USENIX LEET, Boston
SpamCopWiki: SpamTrap (2014) 21 July 2006. http://forum.spamcop.net/scwik/SpamTrap/. Accessed Sept 2014
The Phishload Phishing Test Database. http://www.medien.ifi.lmu.de/team/max.maurer/files/phishload/
Jakobsson M, Myers S (2007) Phishing & countermeasures: understanding the increasing problem of electronic identity theft. Wiley, New York
Sheng S, Magnien B, Kumaraguru P, Acquisti A, Cranor LF, Hong J, Nunge E (2007) Anti-phishing phil: the design and evaluation of a game that teaches people not to fall for phish. In: Proceedings of the SOUPS, Pittsburg, pp 88–99
Markus Jakobsson SM (2007) Phishing and countermeasures, Microsoft’s anti-phishing technologies and tactics. 18 MAY 2007, pp 551562
Project H, Alliance R (2005) Know your enemy: tracking botnets. http://www.honeynet.org/papers/bots/. Accessed Sept 2014
Moore T, Clayton R (2007) Examining the impact of website take-down on phishing. In: eCrime’07: proceedings of the anti-phishing working groups 2nd annual eCrime researchers summit. ACM, New York, NY, USA, pp 1–13
Chhabra M, Gupta BB (2013) A novel solution to handle DDOS attack in MANET. J Inf Secur 4(3):165–179
Gupta BB, Joshi RC, Misra M (2009) Defending against distributed denial of service attacks: issues and challenges. Inf Secur J A Global Perspect 18(5):224–247
NPM (2014) Fpipe. https://www.npmjs.org/package/fpipe. Accessed Sept 2014
Jagatic T, Johnson N, Jakobsson M, Menczer F (2007) Social phishing. Commun ACM 50(10):94–100
Granger S (2001) Social engineering fundamentals, part I: hacker tactics. vol 2006: SecurityFocus
Tom NAJ, Jagatic N (2007) Markus Jakobsson, FilippoMenczer, “Social phishing”. Commun ACM 50:94–100
Spear Phishing Attacks—Why They are Successful and How to Stop Them. Combating the Attack of Choice for Cyber criminals, Fire Eye Inc (Whitepaper)
The Internet Protocol Journal, June 2000, vol 3, no 2. http://www.cisco.com/web/about/ac123/ac147/ac174/ac196/about_cisco_ipj_archive_article09186a00800c8901.pdf
Spear Phishing Email: Most favored APT attack bait (2012) Trend micro incorporated research paper 2012
Adhikary N, Shrivastava R, Kumar A, Verma SK, Bag M, Singh V (2012) Battering keyloggers and screen recording software by fabricating passwords. I. J. Computer Network and Information Security, June 2012
CPNI (2013) Spear phishing: understanding the threat. Sept 2013
Sullivan D (2005) The definitive guide to controlling malware, spyware, phishing and spam. Realtime Publishers
Emigh A (2006) The crimeware landscape: malware, phishing, identity theft and beyond. J Digit Forensic Pract 1(3):245–260
Sagiroglu S, Canbek G (2009) Keyloggers. IEEE technology and society magazine, pp 10–17
Kapoor S (2014) Session hijacking exploiting TCP, UDP and HTTP sessions. http://www.bindview.com/Services/Razor/Papers/2001/tcpseq.cfm. Accessed Sept 2014
Gill R, Smith J, Clark A (2006) Experiences in passively detecting session hijacking attacks in IEEE 802.11 networks. In: ACSW frontiers ‘06: proceedings of the 2006 Australian workshops on grid computing. Darlinghurst, Australia, 2006. Australian Computer Society, Inc, pp 221–230
Christin N, Weigend AS, Chuang J (2005) Content availability, pollution and poisoning in file sharing peer-to-peer networks. In: EC ‘05: proceedings of the 6th ACM conference on electronic commerce. ACM Press, New York, NY, USA, pp 68–77
Perdisci R, Antonakakis M, Luo X, Lee W (2009) “WSEC DNS: protecting recursive DNS resolvers from poisoning attacks”, in DSN. IEEE, Lisbon, pp 3–12
Azad HS, Zomaya AY (2014) Large scale network centric distributed systems. Wiley, New York
Yang LT, Rana OF, Martino BD, Dongarra J (2006) High performance computing and computing. First international conference, HPCC, Springer, Munich, Germany, Sept 2006
Moore T, Clayton R (2008) Evil Searching: compromise and re-compromise of internet hosts for phishing
Dhamija R, Tygar JD, Hearst MA (2006) Why phishing works,” in proceedings of the 2006 conference on human factors in computing systems (CHI). ACM, Montréal, Québec, Canada, pp 581–590
ALmomani A, Gupta BB, Wan T, Altaher A, Manickam S (2013) Phishing dynamic evolving neural fuzzy framework for online detection zero-day phishing email. Indian J Sci Technol 6(1):3960–3964
Chou N, Ledesma R, Teraguchi Y, Mitchell JC (2004) Client-side defense against web-based identity theft. In: NDSS. The Internet Society
Downs JS, Holbrook M, Cranor LF (2007) Behavioral response to phishing risk. Presented at the proceedings of anti-phishing working groups 2nd annual eCrime researchers summit. ACM Conf, Pittsburgh, Pennsylvania, pp 37–44
Huang H, Tan J, Liu L (2009) Countermeasure techniques for deceptive phishing attack. In: International conference on new trends in information and service science, 2009. NISS’09, Korea, pp 636–641
Sheng S, Holbrook M, Kumaraguru P, Cranor LF, Downs J (2010) Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions. In the proceedings of 28th ACM international conference on human factors in computing systems (CHI’10), New York, NY, USA, pp 373–382
Dong X, Clark J, Jacob J (2008) Modelling user-phishing interaction. In: Human system interactions, 2008 conference, Austria, May 2008, pp 627–632
Wu M, Miller RC, Garfinkel SL (2006) Do security toolbars actually prevent phishing attacks? In: Proceedings of the SIGCHI conference on human factors in computing systems, ser. CHI’06, New York, NY, USA, pp 601–610
Egelman S, Cranor LF, Hong J (2008) You’ve been warned: an empirical study of the effectiveness of web browser phishing warnings. In: Proceeding of the twenty-sixth annual SIGCHI conference on human factors in computing systems, ser. CHI’08. ACM, New York, NY, USA, pp 1065–1074
Kumaraguru P, Rhee Y, Acquisti A, Cranor LF, Hong J, Nunge E (2007) Protecting people from phishing: the design and evaluation of an embedded training email system. In: Proceedings of CHI, ACM Conf, California, USA, pp 905–914
Arachchilage NAG, Love S (2013) A game design framework for avoiding phishing attacks. Comput Hum Behav 29(3):706–714
Arachchilage NAG, Cole M (2011) Designing a mobile game for home computer users to protect against “phishing attacks”. Int J e-Learn Secur 1(1/2)
Arachchilage NAG, Love S (2014) Security awareness of computer users: a phishing threat avoidance perspective. Comput Hum Behav 38:304–312
Levine J (2008) DNS blacklists and whitelists, IRTF anti-spam research group, Nov 2008, Internet Draft draft-irtf-asrg-dnsbl-08.txt
Microsoft, Sender ID, 2008. http://www.microsoft.com/. Accessed on Sept 2014
Sheng S, Wardman B, Warner G, Cranor LF, Hong J, Zhang C (2009) An empirical analysis of phishing blacklists. In: Proceedings of the 6th conference in email and anti-spam, ser. CEAS’09, Mountain view, USA, CA, July 2009
Google (2014) Google safe browsing API. http://code.google.com/apis/safebrowsing/. Accessed Oct 2014
Google (2014) Google safe browsing lookup API. https://developers.google.com/safe-browsing/lookup_guide/. Accessed Oct 2014
RFC 3596—Internet Engineering Task Force. https://www.ietf.org/rfc/rfc3596.txt. Accessed Oct 2014
Prakash P, Kumar M, Kompella RR, Gupta M (2010) Phishnet: predictive blacklisting to detect phishing attacks. In: Proceedings of the 29th conference on information communications INFOCOM’10. IEEE Press, Piscataway, NJ, USA, pp 346–350
Cao Y, Han W, Le Y (2008) Anti-phishing based on automated individual white-list. In DIM’08: proceedings of the 4th ACM workshop on digital identity management. ACM, New York, NY, USA, pp 51–60
Likarish P, Dunbar D, Hansen TE (2008) Phishguard: a browser plug-in for protection from phishing. In: 2nd International conference on internet multimedia services architecture and applications, IMSAA, Bangalore, India, pp 1– 6
Cook DL, Gurbani VK, Daniluk M (2008) Phishwish: a stateless phishing filter using minimal rules. In: Tsudik G (ed) Financial cryptography and data security. Springer, Berlin, pp 182–186
Zhang Y, Hong JI, Cranor LF (2007) Cantina: a content-based approach to detecting phishing web sites. In: Proceedings of the 16th international conference on World Wide Web, ser. WWW’07. ACM, New York, NY, USA, pp 639–648
Chou N, Ledesma R, Teraguchi Y, Mitchell JC (2004) Client-side defense against web-based identity theft. In NDSS. The Internet Society
Netcraft (2014) Netcraft toolbar, 2006. http://toolbar.netcraft.com/. Accessed Sept 2014
CloudMark (2014) http://www.cloudmark.com/en/products/cloudmark-desktopone/index. Accessed Sept 2014
Filter IP (2014) http://support.microsoft.com/kb/930168. Accessed Sept 2014
E. toolbar (2014) http://download.cnet.com/eBay-Toolbar/3000-125124-10153544.html?tag=contentMain;downloadLinks. Accessed Sept 2014
Chandrasekaran M, Narayanan K, Upadhyaya S (2006) Phishing email detection based on structural properties. In: New York state cyber security conference (NYS), Albany, NY
Dazeley R, Yearwood JL, Kang BH, Kelarev AV (2010) Consensus clustering and supervised classification for pro ling phishing emails in internet commerce security. In: Knowledge management and acquisition for smart systems and services. Springer Conf, Berlin, Heidelberg, vol 6232, pp 235–246
Gansterer WN, Polz D (2009) E-Mail classification for phishing defense. Presented at the proceedings of 31st European conference on IR research on advances in information retrieval, Springer conference, Toulouse, France, pp 449–460
Robichaux P, Ganger DL (2006) Gone phishing: evaluating anti-phishing tools for windows. Technical report Sept 2006
Liu G, Qiu B, Wenyin L (2010) Automatic detection of phishing target from phishing webpage. In: Pattern recognition (ICPR), 2010 20th international conference, Istanbul, Turkey, Aug 2010, pp 4153–4156
Bazarganigilani M (2011) Phishing E-Mail detection using ontology concept and naive Bayes algorithm. Int J Res Rev Comput Sci 2(2):1–4
Chen J, Guo C (2007) Online detection and prevention of phishing attacks. Communications and networking in China IEEE, 2007, pp 1–7
Kim H, Huh J (2011) Detecting DNS-poisoning-based phishing attacks from their network performance characteristics. Electron Lett 47(11):656–658
Chandrasekaran M, Chinchani R, Upadhaya S (2006) Phoney: mimicking user response to detect phishing attacks. In: Symposium on world of wireless, mobile and multimedia networks, IEEE computer society, pp 668–672
Zhang H, Liu G, Chow T, Liu W (2011) Textual and visual content based anti-phishing: A Bayesian approach. IEEE Trans Neural Netw 22(10):1532–1546
Ma L, Ofoghi B, Watters P, Brown S (2009) Detecting phishing emails using hybrid features. IEEE conference on UIC-ATC ‘09, Brisbane, pp 493–497
Ma L, Yearwood J, Watters P (2009) Establishing phishing provenance using orthographic features. IEEE conference on eCrime’09, Tocoma pp 1–10
Benuskova L, Kasabov N (2007) Evolving connectionist systems (ECOS). In: Computational neurogenetic modeling.: Springer, US, pp 107–126
Alnajim A (2015) A country based model towards phishing detection enhancement. Int J Innov Technol Explor Eng 5(1):52–57
Moghimi M, Varjani AY (2016) New rule-based phishing detection method. Exp Syst Appl 53:231–242
Angelov PP, Filev DP, Kasabov N (2010) Evolving intelligent systems: methodology and applications, vol 12. Wiley, New York
ALmomani A, Wan T, Al-Saedi K, Altaher A, Ramadass S, Manasrah A (2011) An online model on evolving phishing E-mail detection and classification method. J Appl Sci 11(18):3301–3307
Almomani A, Wan T, Altaher A, Manasrah A, ALmomani E, Anbar M, ALomari E, Ramadass S (2012) Evolving fuzzy neural network for phishing emails detection. J Comput Sci 8(7):1099–1107
Almomani BB, Gupta TWan et al (2013) Phishing dynamic evolving neural fuzzy framework for online detection “Zero-day” phishing email. Indian J Sci Technology 6(1):3960–3964
del Castillo M, Iglesias A, Serrano JI (2007) An integrated approach to filtering phishing emails computer aided systems theory. EUROCAST 2007, vol 4739. Springer, Berlin, pp 321–328
Islam MR, Abawajy J, Warren M (2009) Multi-tier phishing email classification with an impact of classifier rescheduling. In: The international symposium on pervasive systems, algorithms, and networks, IEEE conference, Kaohsiung, Taiwan, pp 789–793
Yearwood J, Mamadov M, Banerjee A (2010) Profiling phishing emails based on hyperlink information. In: 2010 International conference on advances in social networks analysis and mining, IEEE conference, Odense, Denmark, pp 120–127
Liu W, Huang G, Liu X, Zhang M, Deng X (2005) Detection of phishing web pages based on visual similarity. In: The proceedings of 14th international world wide web conference Chiba, pp 1060–1061
Fu AY, Wenyin L, Deng X (2006) Detecting phishing web pages with visual similarity assessment based on earth mover’s distance (emd). IEEE Trans Dependable Secur Comput 3(4):301–311
Liu W, Deng X, Huang G, Fu AY (2006) An anti-phishing strategy based on visual similarity assessment. IEEE Internet Comput 10(2):58–65
Medved E, Kirda E, Kruegel C (2008) Visual-similarity-based phishing detection. In: The proceedings of the 4th international conference on security and privacy in communication networks, NY, USA, pp 234–245
Hara M, Yamada A, Miyake Y (2009) Visual similarity-based phishing detection without victim site information. In: IEEE symposium on computational intelligence in cyber security, CICS 2009 Nashville, pp 30–36
Atzori L, Iera A, Morabito G (2010) The internet of things: a survey. Comput Netw 54:2787–2805
Gubbi J, Buyya R, Marusic S, Palaniswami M (2013) Internet of things (IoT): a vision, architectural elements, and future directions. Future Gener Comput Syst 29(7):1645–1660
Roman R, Najera P, Lopez J (2011) Securing the internet of things. Computer 44(9):51–58
Koroneous GL (2015) Enterprise tech spotlight: IoT tipping point, phishing scams, retail breaches. http://news.verizonenterprise.com/2015/08/iot-retail-breaches-phishing-security/
Bertlucci J. Internet of thingbots: the new security worry http://www.informationweek.com/big-data/big-data-analytics/internet-of-thingbots-the-new-security-worry/d/d-id/1234973
Gorman M. The internet of things isn’t safe: thousands of smart gadgets hacked to send spam and phishing emails. http://www.engadget.com/2014/01/17/internet-of-things-hacked-malicious-email-phishing/
Almomani A, Gupta BB, Atawneh S, Meulenberg A, Almomani E (2013) A survey of phishing email filtering techniques. IEEE Commun Surveys Tutor 15(4):2070–2090
Proofpint. Proofpoint uncovers internet of things (IoT) cyberattack. http://investors.proofpoint.com/releasedetail.cfm?releaseid=819799
Mathworks (2014) MATLAB: the language of technical computing. http://www.mathworks.in/products/matlab/. Accessed Oct 2014
WEKA—University of Waikato, New Zealand, EN (2006) Weka-data mining with open source machine learning software in java. http://www.cs.waikato.ac.nz/ml/weka, (2006/01/31). Accessed Sept 2014
Rapidminer (2007) Rapidminer: predictive analysis and data mining. https://rapidminer.com/. Accessed Mar 2016
Rattle: A Data Mining toolkit in R (2013) https://code.google.com/p/rattle/. Accessed Mar 2016
Open NN: An Open Source Neural Networks C Library (2006) http://opennn.cimne.com/. Accessed Sept 2014
Karypis Lab (2006) CLUTO: data clustering software. http://glaros.dtc.umn.edu/gkhome/cluto/cluto/overview. Accessed Mar 2016
Müllner D (2013) fastcluster: Fast hierarchical, agglomerative clustering routines for R and Python. J Stat Softw 53(9):1–18
Munchen (2008) ELKI: environment for developing KDD-application supported by index structures. http://elki.dbs.ifi.lmu.de/. Accessed Mar 2016
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Gupta, B.B., Tewari, A., Jain, A.K. et al. Fighting against phishing attacks: state of the art and future challenges. Neural Comput & Applic 28, 3629–3654 (2017). https://doi.org/10.1007/s00521-016-2275-y
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s00521-016-2275-y