Thesis (M.S. in Computer Science)--Naval Postgraduate School, March 2009. / Thesis Advisor(s): Garfinkel, Simson L. "March 2009." Description based on title screen as viewed on April 24, 2009. Author(s) subject terms: Digital Authentication, S/MIME, Official bulk email, phishing. Includes bibliographical references (p. 55-57). Also available in print.

Thesis (M.S. in Computer Science)--Naval Postgraduate School, September 2006. / Thesis Advisor(s): Craig H. Martell, Neil C. Rowe. "September 2006." Includes bibliographical references (p. 71). Also available in print.

Thesis (M. Phil.)--University of Hong Kong, 2009. / Includes bibliographical references (leaves 137-155). Also available in print.

published_or_final_version / Business / Master / Master of Philosophy

A phishing email is a crime where a scammer sends an email to get sensitive data. Everyday phishing email attacks impact billions of people worldwide. Preparing users to better identify phishing and avoid risky engagement with it is essential to combat this threat. We consider that as phishing emails and email marketing aim to target email clicks, scammers can use marketing practices in phishing emails to achieve their goals. However, the security research community doesn't explore deeply the similarities between phishing and email marketing. This study presents a distinctive framework known as the Phishing Engagement Marketing Optimization (PEMO). The primary objective of PEMO is to provide practices commonly used in email marketing to be applied to phishing simulations. This work presents the methodology to apply PEMO to phishing simulations and a hypothetical scenario to help understanding. We also determined which PEMO practices have a significant effect on phishing email engagement. To address the research problem, we ran an experiment with 400 participants to evaluate how they engage with 100 emails, where 92 were original emails and 8 were phishing emails. We also collected information about the motive of the decision-making behavior. Results showed that lower-risk participants, classified here as non-offenders, were not able to recognize phishing which applied Usability and Influence or Persuasion and Usability practices. In addition, higher-risk participants, classified here as offenders, increased replied and forwarded engagements with phishing which applied Persuasion practices. This work can help information security specialists better prepare users to avoid risky engagements with phishing attacks that apply marketing practices by designing phishing simulations that leverage those same practices.

In “phishing attacks”, phishing websites mimic trustworthy websites in order to steal sensitive information from end-users. Despite research by both academia and the industry focusing on development of anti-phishing detection techniques, phishing has increasingly become an online threat. Our inability to slow down phishing attacks shows that we need to go beyond detection and focus more on understanding the phishing ecosystem. In this thesis, we contribute in three ways to understand the phishing ecosystem and to offer insight for future anti-phishing efforts. First, we provide a new and comparative study on the life cycle of phishing and malware attacks. Specifically, we use public click-through statistics of the Bitly URL shortening service to analyze the click-through rate and timespan of phishing and malware attacks before (and after) they were reported. We find that the efforts against phishing attacks are stronger than those against malware attacks.We also find phishing activity indicating that mitigation strategies are not taking down phishing websites fast enough. Second, we develop a method that finds similarities between the DOMs of phishing attacks, since it is known that phishing attacks are variations of previous attacks. We find that existing methods do not capture the structure of the DOM, and question whether they are failing to catch some of the similar attacks. We accordingly evaluate the feasibility of applying Pawlik and Augsten’s recent implementation of Tree Edit Distance (AP-TED)calculations as a way to compare DOMs and identify similar phishing attack instances.Our method agrees with existing ones that 94% of our phishing database are replicas. It also better discriminates the similarities, but at a higher computational cost. The high agreement between methods strengthens the understanding that most phishing attacks are variations, which affects future anti-phishing strategies.Third, we develop a domain classifier exploiting the history and internet presence of a domain with machine learning techniques. It uses only publicly available information to determine whether a known phishing website is hosted on a legitimate but compromised domain, in which case the domain owner is also a victim, or whether the domain itself is maliciously registered. This is especially relevant due to the recent adoption of the General Data Protection Regulation (GDPR), which prevents certain registration information to be made publicly available. Our classifier achieves 94% accuracy on future malicious domains,while maintaining 88% and 92% accuracy on malicious and compromised datasets respectively from two other sources. Accurate domain classification offers insight with regard to different take-down strategies, and with regard to registrars’ prevention of fraudulent registrations.

Peopel now use E-mail to communicate mutually is widespread. For example, schools convey information to students through e-mail, companies convey to the staff in charge of the task, friends to share the interested things of internet through e-mail and so on. Because of the imperfect of SMTP protocol, the spammer and phisher can delivery phishing e-mail or spam to unknown recipients widely and easily by the forged sender ID. It was result in the recipient's e-mail filled with numerous unsolicited advertising e-mail or faked electronic commerce e-mail. Some content of spam are advertising alone, but some are with harmful attachments, for instance, trojan or virus. Phishing use the name of online banking, Internet auction to delivery numerous e-mail, which let the recipient to believe the contents of the e-mail. By clicking the hyperlink connected to the website of the phishing, and input personal account, password, causing the recipient to lose their money or reputation. Information security software vendor SonicWall 2008¡¦s whitepaper points out that even if the obvious tips of the e-mail which is a phishing e-mail, some percent recipient still click on the hyperlink and input their personal ID and password. This means that the recipinet can easily pay attention to the hyperlink. In this research, by analysising of the information of the URL link in e-mail to detect whether the mail server have been recived phishing e-mail to protect users from phishing in the crisis.

Zugl.: Kiel, Univ., Diss., 2009

Thesis (M.S.)--University of Oregon, 2008. / Typescript. Includes vita and abstract. Includes bibliographical references (leaves 55-62). Also available online.

Phishing emails are a continuing threat in today's society—this study aimed to unpeel the layers on why certain people are prone to phishing emails than others. Participants were presented with twenty legitimate emails as well as twenty phishing emails in random order and were asked to be phishing or not. They were also asked to explain why they chose the answer they believed was right in a couple of sentences. Data was compiled and collected via a Qualtrics survey and analyzed using JASP. Results obtained indicated little to no correlation between the number of features mentioned in the study and classifying and email accuracy as phishing. Studies like this help understand the cognitive constructs that lead to people unknowingly falling in traps set out by phishers and what prompts susceptible victims to think such emails are legitimate rather than seeing the dangers behind them.