Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Bücher
Zeitschriften
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
SLX-Digitalkonferenz: Zukunftswerkstatt 2024

Mehr Umsatz mit Top-Kontakten

Am 7. Mai erfahren Sie, wie Vertriebsteams Leadgenerierung, Leadnurturing und Leadstrategien effizient steuern können.
Erweiterte Suche
Anmelden
nach oben
Telecommunication Systems
Erschienen in: Telecommunication Systems 2/2018

23.05.2017

Defending against phishing attacks: taxonomy of methods, current issues and future directions

verfasst von: B. B. Gupta, Nalin A. G. Arachchilage, Kostas E. Psannis

Erschienen in: Telecommunication Systems | Ausgabe 2/2018

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Internet technology is so pervasive today, for example, from online social networking to online banking, it has made people’s lives more comfortable. Due the growth of Internet technology, security threats to systems and networks are relentlessly inventive. One such a serious threat is “phishing”, in which, attackers attempt to steal the user’s credentials using fake emails or websites or both. It is true that both industry and academia are working hard to develop solutions to combat against phishing threats. It is therefore very important that organisations to pay attention to end-user awareness in phishing threat prevention. Therefore, aim of our paper is twofold. First, we will discuss the history of phishing attacks and the attackers’ motivation in details. Then, we will provide taxonomy of various types of phishing attacks. Second, we will provide taxonomy of various solutions proposed in literature to protect users from phishing based on the attacks identified in our taxonomy. Moreover, we have also discussed impact of phishing attacks in Internet of Things (IoTs). We conclude our paper discussing various issues and challenges that still exist in the literature, which are important to fight against with phishing threats.
Vorheriger Artikel ReDePoly: reducing delays in multi-channel P2P live streaming systems using distributed intelligence
Nächster Artikel Performance analysis of end-to-end SNR estimators for AF relaying

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Jetzt informieren
Literatur
1.
Ramanathan, V., & Wechsler, H. (2012). phishGILLNET—phishing detection methodology using probabilistic latent semantic analysis, AdaBoost, and co-training. EURASIP Journal on Information Security, a Springer Open Journal, 1, 1–22.
2.
Arachchilage, N. A. G., Love, S., & Beznosov, K. (2016). Phishing threat avoidance behaviour: An empirical investigation. Computers in Human Behavior, 60, 185–197.CrossRef
3.
4.
Gupta, B. B., Joshi, R. C., & Misra, M. (2009). Defending against distributed denial of service attacks: Issues and challenges. Information Security Journal: A Global Perspective, 18(5), 224–247.
5.
6.
7.
8.
9.
Sheng, S., Holbrook, M., & Kumaraguru, P. (2010). Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions, CHI, pp. 373–382, Atlanta, GA.
10.
Sheng, S., Holbrook, M., Kumaraguru, P., Cranor, L. F. & Downs, J., (2010). Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions. In 28th international conference on human factors in computing systems, 10–15 April, 2010, Atlanta, GA.
11.
Sheng, S., Magnien, B., Kumaraguru, P., Acquisti, A., Cranor, L. F., Hong, J. & Nunge, E. (2007). Anti-phishing Phil: The design and evaluation of a game that teaches people not to fall for phish. In Proceedings of the 3rd symposium on usable privacy and security, Pittsburgh, PA, July 2007.
12.
13.
14.
15.
16.
Ollmann, G. (2004). The Phishing guide—understanding & preventing phishing attacks. IBM Internet Security Systems.
17.
Breen, C., & Dahlbom, C. A. (1960). Signaling systems for control of telephone switching. Bell System Technical Journal, 39(6), 1381–1444.CrossRef
18.
19.
20% Indians are victims of Online phishing attacks: Microsoft. IANS. news.biharprabha.com. Retrieved 11 February 2014.
20.
21.
Arachchilage, N. A. G., & Love, S. (2014). Security awareness of computer users: A phishing threat avoidance perspective. Computers in Human Behavior, 38, 304–312.CrossRef
22.
Arachchilage, N. A. G., & Love, S. (2013). A game design framework for avoiding phishing attacks. Computers in Human Behavior, 29(3), 706–714.CrossRef
23.
Arachchilage, N. A. G. (2015). User-centred security: A game design to thwart phishing attacks. In International Conference: Redefining the R&D Needs for Australian Cyber Security on November 16, 2015, University of New South Wales at the Australian Defence Force Academy, Canberra. arXiv preprint arXiv:​1511.​03459.
24.
25.
26.
27.
28.
29.
Downs, J. S. et al. (2007). Behavioural response to phishing risk. In Proceedings of the A. C. M. conference on anti-phishing working groups 2nd annual eCrime researchers summit (pp. 37–44). Pittsburgh, PA.
30.
Chen, J., & Guo, C. (2006) Online detection and prevention of phishing attacks. In Proceedings of the fifth Mexican international conference in computer science, IEEE conference, pp. 1–7.
31.
32.
Yu, W. D., Nargundkar, S., & Tiruthani, N. (2008). A phishing vulnerability analysis of web based systems. In Proceedings of the 13th IEEE symposium on computers and communications (ISCC 2008), IEEE. Marrakech, pp. 326–331.
33.
Bergholz, A., Paaß, G., Reichartz, F., Strobel, S., & Chang, J. H. (2008). Improved phishing detection using model based features. In Proceedings on conference on email and anti-spam (CEAS). Mountain View, CA.
34.
Toolan, F., & Carthy, J. (2009). Phishing detection using classifier ensembles. In IEEE conference eCrime researchers summit, (pp. 1–9). Tacoma, WA.
35.
Tally, G., Thomas, R., & Vleck, T. V. (2004). Anti-phishing: Best practices for Institutions and Consumers, Mcafee research technical report, September.
36.
37.
Li, J., Li, J., Chen, X., Jia, C., & Lou, W. (2015). Identity-based encryption with outsourced revocation in cloud computing. IEEE Transactions on Computers., 64(2), 425–437.CrossRef
38.
39.
Almomani, B., Gupta, B., Wan, T., et al. (2013). Phishing dynamic evolving neural fuzzy framework for online detection “Zero-day” phishing email. Indian Journal of Science and Technology, 6(1), 3960–3964.
40.
Srivastava, B., Gupta, B., Tyagi, A., Shamn, A., & Mishra, A. Recent survey on DDoS attacks and defence mechanisms. In Advances in parallel distributed computing, communications in computer and information science, Vol. 203, pp. 570–580.
41.
Khonji, M., Iraqi, Y., & Jones, A. (2013). Phishing detection: A literature survey. IEEE Communications Surveys & Tutorials, 15(4), 2091–2121.CrossRef
42.
Aburrous, M. et al. (2008). Intelligent phishing website detection system using fuzzy techniques, IEEE conference, Damascus, Syria, pp. 1–6.
43.
Aburrous, M. et al. (2010). Predicting phishing websites using classification mining techniques with experimental case studies. In IEEE conference on seventh international conference on information technology (pp. 176–181). Las Vegas, NV.
44.
Almomani, A., Gupta, B. B., Atawneh, S., Meulenberg, A., & Almomani, E. (2013). A survey of phishing email filtering techniques. IEEE Communications Surveys & Tutorials, 15(4), 2070–2090.CrossRef
45.
Hong, J. (2012). The state of phishing attacks. Communications of the ACM, 55(1), 74–81.CrossRef
46.
Chuenchujit, T. (2016). A taxonomy of phishing research. University of Illinois at Urbana-Champaign, Doctoral dissertation.
47.
Dhamija, R., Tygar, J. D. & Hearst, M., (2006). Why phishing works. In Proceedings of the SIGCHI conference on human factors in computing systems, CHI ’06, pp. 581–590, Montréal, Québec, April 22–27, 2006. New York, NY: ACM Press. doi:10.​1145/​1124772.​1124861. Accessed 25 November 2016.
48.
Kumaraguru, P., Rhee, Y., Acquisti, A., Cranor, L. F., Hong, J., & Nunge, E., (2007). Protecting people from phishing: The design and evaluation of an embedded training email system. In Proceedings of the SIGCHI conference on human factors in computing systems, San Jose, CA, April–May 2007.
49.
Kumaraguru, P., Rhee, Y., Sheng, S., Hasan, S., Acquisti, A., & Cranor, L. F., et al. (2007). Getting users to pay attention to anti-phishing education: Evaluation of retention and transfer, APWG eCrime Researchers Summit, 4–5 October 2007, Pittsburgh, PA.
50.
Marforio, C., Masti, R. J., Soriente, C., Kostiainen, K. & Capkun, S., (2016). Hardened setup of personalized security indicators to counter phishing attacks in mobile banking. In Proceedings of the 6th workshop on security and privacy in smartphones and mobile devices (pp. 83–92). New York: ACM.
51.
Vishwanath, A. (2016). Mobile device affordance: Explicating how smartphones influence the outcome of phishing attacks. Computers in Human Behavior, 63, 198–207.CrossRef
52.
Zhao, M., An, B. & Kiekintveld, C. (2016). Optimizing personalized email filtering thresholds to mitigate sequential spear phishing attacks. In Proceedings of the 30th AAAI conference on artificial intelligence (AAAI).
53.
Downs, J. S., Holbrook, M. & Cranor, L. F. (2007). Behavioural response to phishing risk. In Proceedings of the anti-phishing working groups—2nd annual eCrime researchers summit, pp. 37–44, October 2007, Pittsburgh, PA. doi:10.​1145/​1299015.​1299019. Accessed 25 November 2016.
54.
Wu, M., Miller, R. & Garfinkel, S., (2005). Do security toolbars actually prevent phishing attacks? In Proceedings of the SIGCHI conference on human factors in computing systems, Montreal, Quebec, 22–27 April 2006.
55.
Kirlappos, I., & Sasse, M. A. (2012). Security education against phishing: A modest proposal for a major rethink. IEEE Security and Privacy Magazine, 10(2), 24–32.CrossRef
56.
Gupta, B., Agrawal, D. P., & Yamaguchi, S. (eds.) (2016). Handbook of research on modern cryptographic solutions for computer and cyber security. IGI Global.
57.
Bottazzi, G. et al. (2015). MP-shield: A framework for phishing detection in mobile devices. In Proceedings of the 3rd IEEE international workshop on cybercrimes and emerging web environments, Liverpool, October.
58.
Khonji, M., et al. (2012). Enhancing phishing e-mail classifiers: A lexical URL analysis approach. International Journal for Information Security Research, 2(1/2), 236–245.
59.
Khonji, M. et al. (2011). A study of feature subset evaluators and feature subset searching methods for phishing classification. In Proceedings of the 8th annual collaboration, electronic messaging, anti-abuse and spam conference, ACM conference, Perth.
60.
61.
Lyon, J., & Wong, M. (2006). Sender ID: Authenticating E-mail. RFC 4406, April.
62.
Delany, M. (2007). Domain-based email authentication using public keys advertised in the DNS (Domain Keys). RFC 4870, May.
63.
Adida, B., Hohenberger, S., & Rivest, R. L. (2005). Fighting phishing attacks: A light-weight trust architecture for detecting spoofed emails. In USENIX steps to reducing unwanted traffic on the internet workshop (SRUTI).
64.
Chen, J., & Guo, C. (2006). Online detection and prevention of phishing attacks. In Communications and networking in China, ChinaCom ’06, Beijing, pp. 1–7.
65.
Chandrasekaran, M., Narayanan, K., & Upadhyaya, S. (2006). Phishing email detection based on structural properties. In NYS cyber security conference, pp. 1–7.
66.
Gansterer, W. N., & Polz, D. (2009). E-mail classification for phishing defence. In Proceedings of the 31th ECIR research on advances in information retrieval. Springer conference, Toulouse, pp. 449–460.
67.
Park, G., & Taylor, J. M. (2015). Using syntactic features for phishing detection, May.
68.
Kumaraguru, P., Cranshaw, J., Acquisti, A., Cranor, L., Hong, J., Blair, M. A. & Pham, T. (2009). School of phish: A real-world evaluation of anti-phishing training. In Proceedings of the 5th symposium on usable privacy and security, 15–17 July 2009, Mountain View, CA. doi:10.​1145/​1572532.​1572536. Accessed 25 October 2011.
69.
Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F. & Hong, J. (2008). Lessons from a real world evaluation of anti-phishing training. eCrime Researchers Summit, 15–16 October, pp. 1–12.
70.
71.
Arachchilage, N. A. G., (2016). Serious games for cyber security education. Lambert Academic Publishing, pp. 1–244, ISBN-13: 978-3-659-85318-0. [arXiv preprint arXiv:​ 1610.​09511]. Accessed 15 November 2016.
72.
Schuetz, S., Lowry, P. B., & Thatcher, J. (2016). Defending against spear-phishing: Motivating users through fear appeal manipulations. In 20th Pacific Asia conference on information systems (PACIS 2016) (pp.1–12). Chiayi, Taiwan.
73.
74.
Tayal, K., & Rav, V. (2016). Particle swarm optimization trained class association rule mining: Application to phishing detection. In Proceedings of the international conference on informatics and analytics ICIA-16, Article No. 13, Pondicherry, August 25–26.
75.
Tan, C. L., Chiew, K. L., Wong, K., & Sze, S. N. (2016) PhishWHO: Phishing webpage detection via identity keywords extraction and target domain name finder. Decision Support Systems Vol. 88, August, pp. 18–27.
76.
77.
Prakash, P., Kumar, M., Kompella, R. R., & Gupta, M. (2010). PhishNet: Predictive blacklisting to detect phishing attacks. In Proceedings of the INFOCOM-2010 IEEE, San Diego, pp. 1–5.
78.
Han, W., Cao, Y., Bertino, E., & Yong, J. (2012). Using automated individual whitelist to protect web digital identities. Expert Systems with Applications, 39(15), 11861–11869.CrossRef
79.
Chou, N., Ledesma, R., Teraguchi, Y., Boneh, D., & Mitchell, J. C. (2004). Client-side defence against web-based identity theft. In NDSS. The Internet Society.
80.
Wu, Y. -S., Foo, B., Mei, Y., & Bagchi, S. (2003). Collaborative intrusion detection system (CIDS): A framework for accurate and efficient IDS. In Proceedings of the computer security applications conference, 2003, pp. 234–244.
81.
Joshi, Y. et al. (2008). PhishGuard: A browser plugin for protection from phishing. In 2nd international conference on internet multimedia services architecture and applications, 2008. IMSAA 2008. IEEE.
82.
Zhang, Y., Hong, J. I., & Cranor, L. F. (2007). Cantina: A content-based approach to detecting phishing web sites. In Proceedings of the 16th international conference on World Wide Web. New York: ACM.
83.
Medvet, E., Kirda, E., & Kruegel, C. (2008). Visual-similarity-based phishing detection. In Proceedings of the 4th international conference on Security and privacy in communication networks, SecureComm ’08, Article no 2, pp. 1–11.
84.
Mao, J., Li, P., Li, K., Tao, W., & Zhenkai, L. (2013). BaitAlarm: Detecting phishing sites using similarity in fundamental visual features. In 5th international conference on intelligent networking and collaborative system intelligent networking and collaborative systems (IN-CoS), Xi’an, 2013, pp. 790–795.
85.
Amir, H., & Gbara, A. (2004). Trustbar: Protecting (even naive) web users from spoofing and phishing attacks. Computer Science Department Bar Ilan University, July, pp. 1–28.
86.
Dhamija, R., & Tygar, J. D. (2005). The battle against phishing—dynamic security skins. In Proceedings of the 2005 symposium on usable privacy and security, SOUPS ’05, pp. 77 – 88.
87.
Teh-Chung, C., Scott, D., & James, M. (2010). Detecting visually similar web pages: Application to phishing detection. ACM Transactions on Internet Technology (TOIT), 10(2), 5.
88.
Gastellier-Prevost, S., Granadillo, G. G., & Laurent, M. (2011). Decisive heuristics to differentiate legitimate from phishing sites. In IEEE conference on network and information systems security (SAR-SSI), 2011.
89.
Moghimi, M., & Varjani, A. Y. (2016). New rule-based phishing detection method. Expert Systems with Application, 53, 231–242.CrossRef
90.
Solanki, J., & Vaishnav, R. G. (2015). Website phishing detection using heuristic based approach. In Proceedings of the third international conference on advances in computing, electronics and electrical technology.
91.
Atzori, L., Iera, A., & Morabito, G. (2010). The internet of things: A survey. Computer Networks, 54, 2787–2805.CrossRef
92.
93.
94.
95.
Gubbi, J., Buyya, R., Marusic, S., & Palaniswami, M. (2013). Internet of things (IoT): A vision, architectural elements, and future directions. Future Generation Computer Systems, 29(7), 1645–1660.CrossRef
96.
Roman, R., Najera, P., & Lopez, J. (2011). Securing the internet of things. Computer, 44(9), 51–58.CrossRef
97.
Tang, D. (2009). Event detection in sensor networks. School of Engineering and Applied Sciences, The George Washington University.
98.
99.
Arachchilage, N. A. G., & Cole, M. (2011). Design a mobile game for home computer users to prevent from “phishing attacks”. In IEEE International Conference on Information Society (i-Society), 2011, pp. 485–489.
100.
101.
Jain, A. K., & Gupta, B. B. (2016). A novel approach to protect against phishing attacks at client side using auto-updated white-list. EURASIP Journal on Information Security. doi:10.​1186/​s13635-016-0034-3.
102.
Mayer-Schönberger, V. (2011). Failing to forget the “Drunken Pirate”. In: Delete: The virtue of forgetting in the digital age (new in paper), 1st edn. (pp. 3–15). Princeton: Princeton University Press.
Metadaten
Titel
Defending against phishing attacks: taxonomy of methods, current issues and future directions
verfasst von
B. B. Gupta
Nalin A. G. Arachchilage
Kostas E. Psannis
Publikationsdatum
23.05.2017
Verlag
Springer US
Erschienen in
Telecommunication Systems / Ausgabe 2/2018
Print ISSN: 1018-4864
Elektronische ISSN: 1572-9451
DOI
https://doi.org/10.1007/s11235-017-0334-z

Weitere Artikel der Ausgabe 2/2018

Telecommunication Systems 2/2018 Zur Ausgabe

OriginalPaper

Budget-constraint mechanism for incremental multi-labeling crowdsensing

OriginalPaper

Fuzzy logic based 3D localization in wireless sensor networks using invasive weed and bacterial foraging optimization

OriginalPaper

Price competition between a macrocell and a small-cell service provider with limited resources and optimal bandwidth user subscription: a game-theoretical model

OriginalPaper

Challenges and research directions for Internet of Things

OriginalPaper

Radio resource management with QoS guarantees for LTE-A systems: a review focused on employing the multi-objective optimization techniques

OriginalPaper

Determining the number of true different permutation polynomials of degrees up to five by Weng and Dong algorithm

Neuer Inhalt

    Bildnachweise