Learning from the Ones that Got Away: Detecting New Forms of Phishing Attacks
Learning from the Ones that Got Away: Detecting New Forms of Phishing Attacks
复制标题
DOI：
10.1109/tdsc.2018.2864993
复制
发表时间：
2018-11-01
影响因子：
7.3
通讯作者：
Bagchi, Saurabh
中科院分区：
文献类型：
--
作者：
Gutierrez, Christopher N.;Kim, Taegyu;Bagchi, Saurabh
网络钓鱼攻击继续对计算机系统防御者构成重大威胁，通常构成多阶段攻击的第一步。网络钓鱼检测已经取得了很大的进步;然而，一些网络钓鱼电子邮件似乎通过对消息进行简单的结构和语义更改来通过过滤器。我们通过使用机器学习分类器来解决这个问题，该分类器对大型网络钓鱼和合法电子邮件语料库进行操作。我们设计了SAF（E）-PC（半自动特征生成网络钓鱼分类），一个系统来提取特征，提升一些更高级别的功能，这意味着击败常见的网络钓鱼电子邮件检测策略。为了评估SAF（E）-PC，我们从一所一流大学的中央IT组织收集了大量钓鱼电子邮件。SAF（E）-PC在数据集上的执行暴露了针对大学用户的网络钓鱼活动的未知见解。SAF（E）-PC可检测到超过70%的电子邮件，这些电子邮件避开了Sophos的生产部署，Sophos是一种最先进的电子邮件过滤工具。它还优于SpamAssassin，一种常用的电子邮件过滤工具。我们还开发了SAF（E）-PC的在线版本，可以使用新样本进行增量再训练。它的检测性能随着收集新样本的时间而提高，而重新训练分类器的时间保持不变。
Phishing attacks continue to pose a major threat for computer system defenders, often forming the first step in a multi-stage attack. There have been great strides made in phishing detection; however, some phishing emails appear to pass through filters by making simple structural and semantic changes to the messages. We tackle this problem through the use of a machine learning classifier operating on a large corpus of phishing and legitimate emails. We design SAF(E)-PC (Semi-Automated Feature generation for Phish Classification), a system to extract features, elevating some to higher level features, that are meant to defeat common phishing email detection strategies. To evaluate SAF(E)-PC, we collect a large corpus of phishing emails from the central IT organization at a tier-1 university. The execution of SAF(E)-PC on the dataset exposes hitherto unknown insights on phishing campaigns directed at university users. SAF(E)-PC detects more than 70 percent of the emails that had eluded our production deployment of Sophos, a state-of-the-art email filtering tool. It also outperforms SpamAssassin, a commonly used email filtering tool. We also developed an online version of SAF(E)-PC, that can be incrementally retrained with new samples. Its detection performance improves with time as new samples are collected, while the time to retrain the classifier stays constant.