Thesis (M.S. in Computer Science)--Naval Postgraduate School, March 2009. / Thesis Advisor(s): Garfinkel, Simson L. "March 2009." Description based on title screen as viewed on April 24, 2009. Author(s) subject terms: Digital Authentication, S/MIME, Official bulk email, phishing. Includes bibliographical references (p. 55-57). Also available in print.

Thesis (M.S. in Computer Science)--Naval Postgraduate School, September 2006. / Thesis Advisor(s): Craig H. Martell, Neil C. Rowe. "September 2006." Includes bibliographical references (p. 71). Also available in print.

Thesis (M. Phil.)--University of Hong Kong, 2009. / Includes bibliographical references (leaves 137-155). Also available in print.

published_or_final_version / Business / Master / Master of Philosophy

In “phishing attacks”, phishing websites mimic trustworthy websites in order to steal sensitive information from end-users. Despite research by both academia and the industry focusing on development of anti-phishing detection techniques, phishing has increasingly become an online threat. Our inability to slow down phishing attacks shows that we need to go beyond detection and focus more on understanding the phishing ecosystem. In this thesis, we contribute in three ways to understand the phishing ecosystem and to offer insight for future anti-phishing efforts. First, we provide a new and comparative study on the life cycle of phishing and malware attacks. Specifically, we use public click-through statistics of the Bitly URL shortening service to analyze the click-through rate and timespan of phishing and malware attacks before (and after) they were reported. We find that the efforts against phishing attacks are stronger than those against malware attacks.We also find phishing activity indicating that mitigation strategies are not taking down phishing websites fast enough. Second, we develop a method that finds similarities between the DOMs of phishing attacks, since it is known that phishing attacks are variations of previous attacks. We find that existing methods do not capture the structure of the DOM, and question whether they are failing to catch some of the similar attacks. We accordingly evaluate the feasibility of applying Pawlik and Augsten’s recent implementation of Tree Edit Distance (AP-TED)calculations as a way to compare DOMs and identify similar phishing attack instances.Our method agrees with existing ones that 94% of our phishing database are replicas. It also better discriminates the similarities, but at a higher computational cost. The high agreement between methods strengthens the understanding that most phishing attacks are variations, which affects future anti-phishing strategies.Third, we develop a domain classifier exploiting the history and internet presence of a domain with machine learning techniques. It uses only publicly available information to determine whether a known phishing website is hosted on a legitimate but compromised domain, in which case the domain owner is also a victim, or whether the domain itself is maliciously registered. This is especially relevant due to the recent adoption of the General Data Protection Regulation (GDPR), which prevents certain registration information to be made publicly available. Our classifier achieves 94% accuracy on future malicious domains,while maintaining 88% and 92% accuracy on malicious and compromised datasets respectively from two other sources. Accurate domain classification offers insight with regard to different take-down strategies, and with regard to registrars’ prevention of fraudulent registrations.

Peopel now use E-mail to communicate mutually is widespread. For example, schools convey information to students through e-mail, companies convey to the staff in charge of the task, friends to share the interested things of internet through e-mail and so on. Because of the imperfect of SMTP protocol, the spammer and phisher can delivery phishing e-mail or spam to unknown recipients widely and easily by the forged sender ID. It was result in the recipient's e-mail filled with numerous unsolicited advertising e-mail or faked electronic commerce e-mail. Some content of spam are advertising alone, but some are with harmful attachments, for instance, trojan or virus. Phishing use the name of online banking, Internet auction to delivery numerous e-mail, which let the recipient to believe the contents of the e-mail. By clicking the hyperlink connected to the website of the phishing, and input personal account, password, causing the recipient to lose their money or reputation. Information security software vendor SonicWall 2008¡¦s whitepaper points out that even if the obvious tips of the e-mail which is a phishing e-mail, some percent recipient still click on the hyperlink and input their personal ID and password. This means that the recipinet can easily pay attention to the hyperlink. In this research, by analysising of the information of the URL link in e-mail to detect whether the mail server have been recived phishing e-mail to protect users from phishing in the crisis.

Zugl.: Kiel, Univ., Diss., 2009

Thesis (M.S.)--University of Oregon, 2008. / Typescript. Includes vita and abstract. Includes bibliographical references (leaves 55-62). Also available online.

Phishing emails are a continuing threat in today's society—this study aimed to unpeel the layers on why certain people are prone to phishing emails than others. Participants were presented with twenty legitimate emails as well as twenty phishing emails in random order and were asked to be phishing or not. They were also asked to explain why they chose the answer they believed was right in a couple of sentences. Data was compiled and collected via a Qualtrics survey and analyzed using JASP. Results obtained indicated little to no correlation between the number of features mentioned in the study and classifying and email accuracy as phishing. Studies like this help understand the cognitive constructs that lead to people unknowingly falling in traps set out by phishers and what prompts susceptible victims to think such emails are legitimate rather than seeing the dangers behind them.

<p>Because of the development of the Internet and the rapid increase of the electronic commercial, the incidents on stealing the consumers' personal identify data and financial account credentials are becoming more and more common. This phenomenon is called phishing. Now phishing is so popular that web sites such as papal , eBay, MSN, Best Buy, and America Online are frequently spoofed by phishers. What’s more, the amount of the phishing sites is increasing at a high rate.</p><p>The aim of the report is to analyze different phishing phenomenon and help the readers to identify phishing attempts. Another goal is to design an anti-phishing system which can detect the phishing e-mails and then perform some operations to protect the users. Since this is a big project, I will focus on the mail detecting part that is to analyze the detected phishing emails and extract details from these mails.</p><p>A list of the most important information of this phishing mail is extracted, which contains “mail subject”, “ mail received date”, “targeted user”, “the links”, and “expiration and creation date of the domain”. The system can presently extract this information from 40% of analyzed e-mails.</p>