Phishing Email Detection Using Improved RCNN Model With Multilevel Vectors and Attention Mechanism
Phishing Email Detection Using Improved RCNN Model With Multilevel Vectors and Attention Mechanism
复制标题
DOI：
10.1109/access.2019.2913705
复制
发表时间：
2019-01-01
期刊：
影响因子：
3.9
通讯作者：
Yang, Yue
中科院分区：
文献类型：
--
作者：
Fang, Yong;Zhang, Cheng;Yang, Yue
钓鱼邮件是当今世界面临的重大威胁之一，已经造成了巨大的经济损失。尽管对抗方法在不断更新，但目前这些方法的效果并不是很理想。此外，钓鱼电子邮件近年来正以惊人的速度增长。因此，需要更有效的钓鱼检测技术来遏制钓鱼邮件的威胁。本文首先分析了电子邮件的结构。然后，基于改进的具有多层向量和注意力机制的递归卷积神经网络(RCNN)模型，提出了一种新的钓鱼邮件检测模型THEMIS，该模型同时对邮件头、邮件正文、字符和单词四个层面的邮件进行建模。为了评估THEMIS的有效性，我们使用了一个不平衡的数据集，该数据集具有真实的钓鱼电子邮件和合法电子邮件的比例。实验结果表明，THEMIS的总体准确率达到99.848%。假阳性率为0.043%。高准确率和低FPR保证了过滤器能够识别高概率的钓鱼邮件，过滤掉尽可能少的合法邮件。这一有希望的结果优于现有的检测方法，验证了THEMIS在检测钓鱼邮件方面的有效性。
The phishing email is one of the significant threats in the world today and has caused tremendous financial losses. Although the methods of confrontation are continually being updated, the results of those methods are not very satisfactory at present. Moreover, phishing emails are growing at an alarming rate in recent years. Therefore, more effective phishing detection technology is needed to curb the threat of phishing emails. In this paper, we first analyzed the email structure. Then, based on an improved recurrent convolutional neural networks (RCNN) model with multilevel vectors and attention mechanism, we proposed a new phishing email detection model named THEMIS, which is used to model emails at the email header, the email body, the character level, and the word level simultaneously. To evaluate the effectiveness of THEMIS, we use an unbalanced dataset that has realistic ratios of phishing and legitimate emails. The experimental results show that the overall accuracy of THEMIS reaches 99.848%. Meanwhile, the false positive rate (FPR) is 0.043%. High accuracy and low FPR ensure that the filter can identify phishing emails with high probability and filter out legitimate emails as little as possible. This promising result is superior to the existing detection methods and verifies the effectiveness of THEMIS in detecting phishing emails.