Abstract:Email phishing has become more prevalent and grows more sophisticated over time. To combat this rise, many machine learning (ML) algorithms for detecting phishing emails have been developed. However, due to the limited email data sets on which these algorithms train, they are not adept at recognising varied attacks and, thus, suffer from concept drift; attackers can introduce small changes in the statistical characteristics of their emails or websites to successfully bypass detection. Over time, a gap develops between the reported accuracy from literature and the algorithm's actual effectiveness in the real world. This realises itself in frequent false positive and false negative classifications. To this end, we propose a multidimensional risk assessment of emails to reduce the feasibility of an attacker adapting their email and avoiding detection. This horizontal approach to email phishing detection profiles an incoming email on its main features. We develop a risk assessment framework that includes three models which analyse an email's (1) threat level, (2) cognitive manipulation, and (3) email type, which we combine to return the final risk assessment score. The Profiler does not require large data sets to train on to be effective and its analysis of varied email features reduces the impact of concept drift. Our Profiler can be used in conjunction with ML approaches, to reduce their misclassifications or as a labeller for large email data sets in the training stage. We evaluate the efficacy of the Profiler against a machine learning ensemble using state-of-the-art ML algorithms on a data set of 9000 legitimate and 900 phishing emails from a large Australian research organisation. Our results indicate that the Profiler's mitigates the impact of concept drift, and delivers 30% less false positive and 25% less false negative email classifications over the ML ensemble's approach.

Predicting User Susceptibility to Phishing Based on Multidimensional Features

Investigation of Phishing Susceptibility with Explainable Artificial Intelligence

Predicting susceptibility to social influence in phishing emails

Using a Computational Cognitive Model to Understand Phishing Classification Decisions of Email Users

Profiler: Profile-Based Model to Detect Phishing Emails

A Classifier Model to Detect Phishing Emails Using Ensemble Technique

SoK: Human-Centered Phishing Susceptibility

Multilayer Approach to Defend Phishing Attacks

Phishing Attacks Detection -- A Machine Learning-Based Approach

Analyzing the risk and financial impact of phishing attacks using a knowledge based approach

Phishing in an Academic Community: A Study of User Susceptibility and Behavior

Quantifying Susceptibility to Spear Phishing in a High School Environment Using Signal Detection Theory

Protect sensitive sites from phishing attacks using features extractable from inaccessible phishing URLs

An efficient multistage phishing website detection model based on the CASE feature framework: Aiming at the real web environment

Email Summarization to Assist Users in Phishing Identification

PDHF: Effective phishing detection model combining optimal artificial and automatic deep features

Psychological Predictors of Online Fraud Victimhood in China: a Machine Learning Approach

An intelligent cyber security phishing detection system using deep learning techniques

Phishing Detection Based on Multi-Feature Neural Network.

Towards a Multi-Layered Phishing Detection

Real or Bogus: Predicting Susceptibility to Phishing with Economic Experiments