Source-linked AI summary
Defending against Phishing Attacks: Taxonomy of Methods, Current Issues and Future Directions
B. B. Gupta, Nalin Asanka Gamagedara Arachchilage, Konstantinos E. Psannis
TL;DR
Phishing threatens users by stealing credentials through deceptive emails and websites, while attackers exploit human factors and changing vulnerabilities. The paper surveys phishing history, motivations, attack types, defenses, and IoT impacts, organizing attacks and protections into taxonomies. It highlights user-awareness gaps, reports that participants made mistakes 40% of the time in one study, and concludes that no single solution defeats evolving phishing strategies.
Problem
Phishers exploit human factors and changing vulnerabilities to steal credentials, while end-user education remains less studied than technical prevention and detection.
Method
The paper surveys phishing literature and develops taxonomies of attack types and protection schemes, including email filtering and phishing-website detection.
Results
40% of participants made mistakes in a phishing test, while the survey identifies multiple attack and defense classifications and discusses IoT phishing threats.
Takeaways & Limitations
Phishing defense requires attention to user awareness alongside technical protections because attackers continually change strategies to exploit vulnerabilities.
Abstract
from arXiv · showhide
Internet technology is so pervasive today, for example, from online social networking to online banking, it has made people's lives more comfortable. Due the growth of Internet technology, security threats to systems and networks are relentlessly inventive. One such a serious threat is "phishing", in which, attackers attempt to steal the user's credentials using fake emails or websites or both. It is true that both industry and academia are working hard to develop solutions to combat against phishing threats. It is therefore very important that organisations to pay attention to end-user awareness in phishing threat prevention. Therefore, the aim of our paper is twofold. First, we will discuss the history of phishing attacks and the attackers' motivation in details. Then, we will provide taxonomy of various types of phishing attacks. Second, we will provide taxonomy of various solutions proposed in literature to protect users from phishing based on the attacks identified in our taxonomy. Moreover, we have also discussed impact of phishing attacks in Internet of Things (IoTs). We conclude our paper discussing various issues and challenges that still exist in the literature, which are important to fight against with phishing threats.
C. Phishing Lifecycle
The phishing lifecycle has three recurring phases: targeting and campaign preparation, user interaction with phishing messages, and redirection to phishing sites.
- Phishers first explore organizations, select targets, create phishing websites, and distribute spam emails.
- The second phase begins when users read the phishing emails and click embedded links.
- The third phase redirects users to phishing websites after they engage with the phish.
- Figure 11 presents the lifecycle for attacks based on phishing emails and phishing websites.
D. Motivation
Phishers exploit human inattention for financial, personal, organizational, reputational, or technical objectives, while phishing research evaluates detection using several classification and feature-selection metrics.
- Motivation: Phishers exploit users’ tendency to ignore critical warnings, with financial gain identified as the primary motivation.
- Motivation: Motivations include stealing banking credentials, capturing personal information, and acquiring trade secrets or confidential documents.
- Motivation: Some attacks pursue fame and notoriety or exploit security holes rather than directly seeking financial gain.
- Performance Evaluation: True Positive measures phishing pages correctly detected as phishing relative to all phishing pages visited.
- Performance Evaluation: True Negative measures legitimate pages correctly detected as legitimate relative to all legitimate pages visited.
- Performance Evaluation: Precision, recall, f-score, accuracy, and weighted error provide additional measures for detection and feature evaluation.
III. TAXONOMY OF PHISHING ATTACKS
The taxonomy divides phishing according to how attackers obtain victims’ personal information, distinguishing social-engineering deception from technical subterfuge.
- Phishing attacks are classified by whether attackers defraud victims or use malicious code to access personal information.
- Technical Subterfuge: Technical subterfuge uses malicious code, key loggers, or screen capture to steal credentials or personal information.
- Social Engineering: Social engineering includes spoofed emails and fake websites that deceive users into disclosing information.
- Social Engineering: Whaling targets high-profile employees through social engineering to obtain confidential organizational or banking information.
- Social Engineering: Fake websites imitate legitimate sites visually and use embedded links or advertisements to obtain victims’ personal information.
- Technical Subterfuge: Technical subterfuge encompasses XSS, session hijacking, malware phishing, DNS poisoning, and key or screen loggers.
IV. TAXONOMY OF DEFENSE MECHANISHMS
The paper classifies phishing defenses according to whether they filter spoofed emails or detect phishing websites, then groups them by shared properties.
- Defense solutions are divided into email filtering schemes and phishing-website detection schemes.
- Email-filtering defenses include network-based protection, blacklist schemes, and heuristic schemes.
- The classifications also organize solutions by common properties such as network mechanisms, heuristics, and features.
A. User Education
User studies show that people frequently miss phishing cues even when they know about phishing, while research on end-user education remains limited. Improving users’ threat perception is therefore identified as an important research direction.
- A. User Education: Users’ limited understanding of phishing and difficulty interacting with security systems are reported as major reasons they continue to fall for attacks.The cited literature links these difficulties to users’ responses to phishing warnings and security cues.
- A. User Education: Many users ignored passive toolbar security indicators and judged websites primarily by their content.Users also had difficulty recognizing unfamiliar risks and understanding how sophisticated phishing attacks can be.
- A. User Education: Little research has addressed end-user education compared with phishing prevention and detection for emails, URLs, and websites.The paper calls for further research on anti-phishing education.
B. Protection from Phishing Emails
Protection from phishing emails spans authentication, filtering, feature-based classification, and user education. The surveyed approaches offer different coverage and deployment choices but face limitations including false positives, complexity, misclassification, and weak protection against evolving attacks.
- B. Protection from Phishing Emails: Blacklist and DNS-based approaches require continuous updates and can be bypassed when attackers use legitimate systems or different IP addresses.DNS-based blacklists also require infrastructure capable of handling large DNS resource records efficiently.
- B. Protection from Phishing Emails: Email protection includes authentication, network-level filtering, feature extraction, machine-learning classification, and user-education approaches.The reviewed systems operate at different points, including before messages reach the inbox and across mail-transfer infrastructure.
- B. Protection from Phishing Emails: Authentication approaches verify whether senders or requested resources are valid, but passwords can be cracked and some schemes require both sides to use the same technology.Examples include Microsoft Sender ID and Yahoo Domain Key.
- B. Protection from Phishing Emails: SVM is commonly deployed server-side to classify phishing emails before they reach clients, using structural email features.One reviewed implementation selected only 25 features, but its experimental results were considered insufficient for large datasets.
- B. Protection from Phishing Emails: Feature-based and statistical classifiers include k-NN, Naive Bayes, Information Gain, and dynamic Markov models.These methods classify emails using similarity, probabilistic text features, selected information, or trained feature sequences.
- B. Protection from Phishing Emails: Reviewed email-classification systems report high false-positive rates, large numbers of misclassified emails, low accuracy, or high time and storage complexity.These limitations vary across the surveyed filtering and classifier approaches.
- B. Protection from Phishing Emails: User-education approaches assess training materials, online tests, and embedded training, but some studies used participants more educated than average Internet users.Suggested practices include short training materials and immediate training after a phishing incident.
C. Protection from Phishing Websites
Phishing-website defenses use URL patterns, blacklists and whitelists, heuristics, authentication behavior, content similarity, and visual similarity. The approaches target different attack characteristics, while their limitations include zero-day coverage gaps, false positives, and implementation complexity.
- C. Protection from Phishing Websites: URL-based defenses extract identity keywords or generate URL variants using domain, directory, IP, query-string, and brand-name similarities.PhishNet addresses exact-matching weaknesses by generating possible variants of blacklisted URLs.
- C. Protection from Phishing Websites: Blacklists identify previously detected phishing URLs or IP addresses, while whitelists collect legitimate addresses and can reduce false positives.Blacklists do not protect against new addresses or sites that have not yet been detected.
- C. Protection from Phishing Websites: Heuristic detection is reported as effective against zero-day phishing attacks but carries a risk of high false positives.The surveyed browsers include heuristic-based phishing detection.
- C. Protection from Phishing Websites: Collaborative intrusion detection exchanges untrusted data among intrusion-detection systems, but the described approach was not implemented because of its complexity.The systems monitor suspicious addresses and analyze connections to detect malicious origins.
- C. Protection from Phishing Websites: PhishGuard tests credential-handling behavior by sending a known user ID with a different password and interpreting the HTTP response and password hash.A stored hash leads it to classify the site as phishing; otherwise, it asks the user to re-enter the password.
- C. Protection from Phishing Websites: CANTINA represents webpage content with the highest TF-IDF terms, queries a search engine, and compares the page’s domain with returned domains.Additional heuristics address domain age, suspicious URL characters, excessive dots, and embedded forms.
- C. Protection from Phishing Websites: Visual-similarity defenses compare page text, images, layouts, or CSS when users enter information on untrusted webpages.The motivation is that phishing pages often imitate the appearance and URL patterns of legitimate targets.
V. PHISHING AND INTERNET OF THINGS
The paper identifies phishing as an expanding threat in Internet of Things environments, where connected devices and distributed attacks create additional exposure.
- IoT connects smart devices and sensors across homes, schools, vehicles, and bodies, expanding the environments exposed to phishing threats.
- 37% of intrusions in IT organizations during the first half of 2015 resulted from phishing attacks.
- Phishing emails commonly redirect users to malicious webpages that may remain available for only a few hours, reducing blacklist effectiveness.
- Proofpoint reported bulk spam sent three times daily in 2015, with 25% of hosting devices being televisions and refrigerators alongside routers.
- IoT attacks are highly distributed, allowing malicious emails to reach inboxes successfully.
VI. CURRENT ISSUES AND CHALLENGES
Existing phishing defenses address emails and websites through multiple techniques, but changing attacks, false positives, resource demands, and limited evaluation leave important challenges unresolved.
- No single phishing defense is comprehensive because attackers change strategies by exploiting vulnerabilities in existing solutions.
- Blacklist methods require periodic updates, consume resources with many records, and cannot reliably prevent zero-day attacks or changed addresses.
- Server-side spam filters can be evaded when phishers alter the words or phrases used in phishing messages.
- Authentication improves security at user and server levels, but passwords can still be cracked by phishers.
- SVM-based email classification was evaluated with only 25 features, and the reported experiments were insufficient for large datasets.
- Heuristic methods can detect zero-day attacks but produce more false positives and have high time complexity.
- Visual similarity detection examines page appearance and credential destinations, while comparison schemes remain vulnerable to image-based or subtle content differences.
- The literature still lacks a complete solution for Internet users, organizations, service providers, and lightweight IoT devices.
VII. CONCLUSION AND SCOPE FOR FUTURE WORK
The paper surveys phishing history, attacks, defenses, and IoT impacts, then organizes social-engineering attacks and countermeasures into taxonomies. It concludes that unresolved issues and changing attacker strategies require continued research.
- The survey examines phishing's persistence, its effects on online commerce, and the failure of existing solutions to eliminate the threat.
- The paper classifies social-engineering phishing into spoofed email attacks and fake websites.
- Defenses are classified as spoofed-email filtering or fake-page detection and further grouped by blacklist, network, heuristic, feature, and other properties.
- The classifications and discussion of current challenges are intended to support future study of phishing defense.