Search

To protect civilian Global Positioning System (GPS) users from spoofing, the Air Force Research Lab has developed the chips-message robust authentication (Chimera) signal enhancement for the GPS L1C signal. With Chimera, standalone receivers that only have access to the GPS signal will be able to authenticate their received measurements once every 3 min, whereas users with access to an out-of-band source will be able to perform authentication once every 1.5 or 6 s. However, moving receivers typically rely on much faster real-time GPS update rates of 1-20 Hz. In this work, we design a spoofing-resilient filter framework that provides continuous and secure state estimation between Chimera authentication times. By leveraging self-contained sensors on-board the vehicle, such as an inertial measurement unit or wheel encoder, as well as the periodic Chimera authentication, our proposed filter determines how much to rely on the received unauthenticated GPS measurements for state estimation. In this respect, our filter relies more extensively on GPS measurements in order to improve real-time navigation performance and reduce localization errors when GPS signals are authentic, while successfully mitigating spoofing-induced errors during an experienced attack. We experimentally validate our proposed spoofing-resilient filter in a simulated test environment for a ground vehicle model with access to the 3-min Chimera channel, under various simulated spoofing attack scenarios. To the best of the authors' knowledge, this is the first adaptive filter proposed for Chimera that continuously leverages real-time GPS measurements in a spoofing-resilient manner. [ABSTRACT FROM AUTHOR]

Objective: The present study investigated if the same users are vulnerable to phishing emails, scam text messages, and fake news headlines and if there are universal predictors of susceptibility for all three tasks. Background: Theoretical research provides support for the notion that the same users likely fall for multiple forms of online deception. However, no research has directly compared susceptibility for various online deceptions (eg phishing, disinformation, scam text messages) within the same group of users. Method: Participants completed an online survey consisting of demographic questions, the Cognitive Reflection Test (ie impulsivity), and the Digital Literacy Scale, and classified 90 legitimate and deceptive emails, text messages, and news headlines. Results: Results suggest that individuals who struggle to discriminate between deceptive and legitimate stimuli on one task experience similar difficulties on the other two tasks. Additionally, while lower levels of digital literacy and cognitive reflectiveness predicted poorer discrimination abilities across all three tasks, age did not predict performance. Interestingly, participants appeared to be the most susceptible to phishing emails. Conclusion: Overall, individuals who fall for one form of online deception appear to be more likely to fall for other forms of deception, and digital literacy and cognitive reflectiveness can predict widespread vulnerability to online deception. [ABSTRACT FROM AUTHOR]

This article investigates the changes in the use of traditional and new media by different technology generations. Focusing on the changes in the use of Email, Chat and Social Network Sites by older people, it explores the process by which new media become 'old' and reach a saturation point. Collected survey data suggest differences in media use between the three technology generations distinguished in this study: the 'mechanical' generation (born in 1938 or before), the 'household revolution' generation (born between 1939 and 1948), and the 'technology spread' generation (born between 1949 and 1963). This longitudinal and transnational study provides evidence of media saturation, showing that an increase in both the availability of and access to media does not lead to an increase in use, even in older adults who are behind in the adoption of the new media. Finally, the article discusses the findings, arguing for an interplay between individual and structural lag in later life. [ABSTRACT FROM AUTHOR]

Smartphone users use the mobile browser to interact with web-based applications. However, mobile browsers are vulnerable to various types of attacks such as phishing, DDoS, etc. There are numerous methods for detecting such attacks on the desktop environment, but, due to hardware limitations, such methods may not be effective for smartphones. Therefore, this paper presents different types of possible cyber-attacks in mobile browsers, and their solutions provided by various researchers to avoid such attacks. Additionally, the survey provides different types of mobile browser-related TLS errors and security indicators related challenges. We have discussed the consequences of emerging domains like mobile payment systems and online meetings. This survey will help the various mobile users in avoiding cyber-attacks while using the Internet for their day-to-day activities and will encourage researchers in designing new effective solutions against various types of mobile-specific cyber-attacks. [ABSTRACT FROM AUTHOR]

Amidst an unprecedented period of technological progress, incorporating digital platforms into diverse domains of existence has become indispensable, fundamentally altering the operational processes of governments, businesses, and individuals. Nevertheless, the swift process of digitization has concurrently led to the emergence of cybercrime, which takes advantage of weaknesses in interconnected systems. The growing dependence of society on digital communication, commerce, and information sharing has led to the exploitation of these platforms by malicious actors for hacking, identity theft, ransomware, and phishing attacks. With the growing dependence of organizations, businesses, and individuals on digital platforms for information exchange, commerce, and communication, malicious actors have identified the susceptibilities present in these systems and have begun to exploit them. This study examines 28 research papers focusing on intrusion detection systems (IDS), and phishing detection in particular, and how quickly responses and detections in cybersecurity may be made. We investigate various approaches and quantitative measurements to comprehend the link between reaction time and detection time and emphasize the necessity of minimizing both for improved cybersecurity. The research focuses on reducing detection and reaction times, especially for phishing attempts, to improve cybersecurity. In smart grids and automobile control networks, faster attack detection is important, and machine learning can help. It also stresses the necessity to improve protocols to address increasing cyber risks while maintaining scalability, interoperability, and resilience. Although machine-learning-based techniques have the potential for detection precision and reaction speed, obstacles still need to be addressed to attain real-time capabilities and adjust to constantly changing threats. To create effective defensive mechanisms against cyberattacks, future research topics include investigating innovative methodologies, integrating real-time threat intelligence, and encouraging collaboration. [ABSTRACT FROM AUTHOR]

In South Korea, the rapid proliferation of smartphones has led to an uptick in messenger phishing attacks associated with electronic communication financial scams. In response to this, various phishing detection algorithms have been proposed. However, collecting messenger phishing data poses challenges due to concerns about its potential use in criminal activities. Consequently, a Korean phishing dataset can be composed of imbalanced data, where the number of general messages might outnumber the phishing ones. This class imbalance problem and data scarcity can lead to overfitting issues, making it difficult to achieve high performance. To solve this problem, this paper proposes a phishing messages classification method using Biased Discriminant Analysis without resorting to data augmentation techniques. In this paper, by optimizing the parameters for BDA, we achieved exceptionally high performances in the phishing messages classification experiment, with 95.45% for Recall and 96.85% for the BA metric. Moreover, when compared with other algorithms, the proposed method demonstrated robustness against overfitting due to the class imbalance problem and exhibited minimal performance disparity between training and testing datasets. [ABSTRACT FROM AUTHOR]

The extent to which the metaverse will become a site for religious and spiritual experience depends on how the aims of users align with the new medium's potentialities for action, or "affordances". Affordances are formed as the social, technological, and contextual capacities of a medium are recognized and then enacted by users. This exploratory essay argues that the metaverse's affordances, which overlap with those of already existing virtual reality (VR) environments, can deepen a sense of belonging for users of online religious spaces and mediate new ways of being present in those spaces. The following affordances of the metaverse (and of VR) are discussed analytically in the essay: immersion, presence, embodiment, usability, empathy, and contemplation. The phases of the continuing "buildout" of the metaverse are also assessed to uncover their likely effects on the metaverse's affordances. These phases are massive scale, system interoperability, robust rendering, and persistent continuity. [ABSTRACT FROM AUTHOR]

Phishing is one of the most dangerous attacks targeting individuals, organizations, and nations. Although many traditional methods for email phishing detection exist, there is a need to improve accuracy and reduce false-positive rates. Our work investigates one-dimensional CNN-based models (1D-CNNPD) to detect phishing emails in order to address these challenges. Additionally, further improvement is achieved with the augmentation of the base 1D-CNNPD model with recurrent layers, namely, LSTM, Bi-LSTM, GRU, and Bi-GRU, and experimented with the four resulting models. Two benchmark datasets were used to evaluate the performance of our models: Phishing Corpus and Spam Assassin. Our results indicate that, in general, the augmentations improve the performance of the 1D-CNNPD base model. Specifically, the 1D-CNNPD with Bi-GRU yields the best results. Overall, the performance of our models is comparable to the state of the art of CNN-based phishing email detection. The Advanced 1D-CNNPD with Leaky ReLU and Bi-GRU achieved 100% precision, 99.68% accuracy, an F1 score of 99.66%, and a recall of 99.32%. We observe that increasing model depth typically leads to an initial performance improvement, succeeded by a decline. In conclusion, this study highlights the effectiveness of augmented 1D-CNNPD models in detecting phishing emails with improved accuracy. The reported performance measure values indicate the potential of these models in advancing the implementation of cybersecurity solutions to combat email phishing attacks. [ABSTRACT FROM AUTHOR]

Phishing, a well-known cyberattack that cannot be completely eradicated from the Internet, has increased dramatically since the COVID-19 pandemic. Despite previous efforts to reduce this prevalent Internet threat, constantly changing attacks make phishing detection a difficult task. The lack of continuous learning support provided by existing solutions and the lack of a systematic knowledge acquisition process make its detection more difficult. SmartiPhish is introduced in this context as the first anti-phishing solution with integrated continuous learning support with an innovative knowledge acquisition process. SmartiPhish combines deep learning and reinforcement learning to have a successful phishing detection solution. The deep learning model predicts a phishing probability for a given web page based on the URL and HTML content, and the probability is then passed to a reinforcement learning environment to make a decision based on the popularity of the web page and prior knowledge of it. SmartiPhish has a detection accuracy of 96.40% and a detection time of 4.3 s. SmartiPhish performs well in an imbalanced environment, and zero-day attack detection is also interesting. Furthermore, SmartiPhish demonstrated a 5.65% performance improvement in just six weeks, in contrast to the existing anti-phishing tools' declining performance trend over time. [ABSTRACT FROM AUTHOR]

The recent surge in phishing incidents in the post-COVID era poses a serious threat towards the social and economic well-being of users. The escalation in dependency upon the internet for meeting daily chores has made them vulnerable to falling prey to the ever-evolving menace of phishing. The objective of this article is: to explore different tactics and motivational factors behind phishing, identify the communication mediums through which phishing is circulated and perform a detailed review along with a comparison of the various surveys in this domain. Another objective is to determine the open research challenges in this genre and to identify the scope of research in the future. An extensive literature survey is performed, which includes articles from eminent online research databases. Barring a few initial articles related to phishing, the articles published in Science Citation/Scopus-indexed journals and survey/review articles published in the last ten years are considered. Highly cited works are given preference. The search query returned numerous articles, which were narrowed by title screening. Further screening of articles was performed by reading the abstract and eliminating the articles related to user-oriented phishing interventions. Eventually, 25 survey articles were shortlisted to be surveyed. This article is an effort to provide a novel taxonomy of phishing to academia that would assist in identifying the sections where phishing countermeasures are inadequate. [ABSTRACT FROM AUTHOR]

In recent years, the popularity of using data science for decision-making has grown significantly. This rise in popularity has led to a significant learning challenge known as concept drifting, primarily due to the increasing use of spatial and temporal data streaming applications. Concept drift can have highly negative consequences, leading to the degradation of models used in these applications. A new model called BOASWIN-XGBoost (Bayesian Optimized Adaptive Sliding Window and XGBoost) has been introduced in this work to handle concept drift. This model is designed explicitly for classifying streaming data and comprises three main procedures: pre-processing, concept drift detection, and classification. The BOASWIN-XGBoost model utilizes a method called Bayesian-Optimized Adaptive Sliding Window (BOASWIN) to identify the presence of concept drift in the streaming data. Additionally, it employs an optimized XGBoost (eXtreme Gradient Boosting) model for classification purposes. The hyperparameter tuning approach known as BO-TPE (Bayesian Optimization with Tree-structured Parzen Estimator) is employed to fine-tune the XGBoost model's parameters, thus enhancing the classifier's performance. Seven streaming datasets were used to evaluate the proposed approach's performance, including Agrawal_a, Agrawal_g, SEA_a, SEA_g, Hyperplane, Phishing, and Weather. The simulation results demonstrate that the suggested model achieves impressive accuracy values of 70.83%, 71.02%, 76.76%, 76.96%, 84.26%, 95.53%, and 78.35% on the corresponding datasets, affirming its superior performance in handling concept drift and classifying streaming data. [ABSTRACT FROM AUTHOR]

The escalating reliance on revolutionary online web services has introduced heightened security risks, with persistent challenges posed by phishing despite extensive security measures. Traditional phishing systems, reliant on machine learning and manual features, struggle with evolving tactics. Recent advances in deep learning offer promising avenues for tackling novel phishing challenges and malicious URLs. This paper introduces a two-phase stack generalized model named AntiPhishStack, designed to detect phishing sites. The model leverages the learning of URLs and character-level TF-IDF features symmetrically, enhancing its ability to combat emerging phishing threats. In Phase I, features are trained on a base machine learning classifier, employing K-fold cross-validation for robust mean prediction. Phase II employs a two-layered stacked-based LSTM network with five adaptive optimizers for dynamic compilation, ensuring premier prediction on these features. Additionally, the symmetrical predictions from both phases are optimized and integrated to train a meta-XGBoost classifier, contributing to a final robust prediction. The significance of this work lies in advancing phishing detection with AntiPhishStack, operating without prior phishing-specific feature knowledge. Experimental validation on two benchmark datasets, comprising benign and phishing or malicious URLs, demonstrates the model's exceptional performance, achieving a notable 96.04% accuracy compared to existing studies. This research adds value to the ongoing discourse on symmetry and asymmetry in information security and provides a forward-thinking solution for enhancing network security in the face of evolving cyber threats. [ABSTRACT FROM AUTHOR]

Phishing attacks use fraudulent websites that trick people into disclosing sensitive information. More effective and precise methods are required to identify phishing websites so that people and organisations can be protected from the damaging effects of these online threats. The aim of this work is to develop a model that can identify phishing uniform resource locator (URLs) more accurately than current approaches while requiring less training time, testing time, and storage space. This research work proposes a novel method for identifying phishing websites using a long short-term memory (LSTM) gated recurrent unit (GRU) algorithm to detect phishing URLs. The accuracy of the suggested method is 98.89%, which is significantly better than the findings of earlier studies. The model also showed a need for shorter training and testing time, and a reduced amount of storage space. [ABSTRACT FROM AUTHOR]

Phishing is a very dangerous security threat that affects individuals as well as companies and organizations. To fight the risks associated with this threat, it is important to detect phishing websites in a timely manner. Machine learning models work well for this purpose as they can predict phishing cases, using information on the underlying websites. In this paper, we contribute to the research on the detection of phishing websites by proposing an explainable machine learning model that can provide not only accurate predictions of phishing, but also explanations of which features are most likely associated with phishing websites. To this aim, we propose a novel feature selection model based on Lorenz Zonoids, the multidimensional extension of Gini coefficient. We illustrate our proposal on a real dataset that contains features of both phishing and legitimate websites. [ABSTRACT FROM AUTHOR]

In this growing world of the internet, most of our daily routine tasks are somehow connected to the internet, from smartphones to internet of things (IoT) devices to cloud networks. Internet users are growing rapidly, and the internet is accessible to everyone from anywhere. Data phishing is a cyber security attack that uses deception to trick internet users to get their content and information. In this attack, malicious users try to steal personal data such as login credentials, credit card details, health care information, etc., of the users on the internet. They exploit users' sensitive information using vulnerabilities. Information stealers are known as phishers. Phishers use different techniques for phishing. One of the most common methods is to direct the users to a false website to enter their login credentials and their details on these phishing sites. Phishing websites look like the original websites. Phishers use these details to get access to the user's accounts and hijack them for monetary purposes. Many internet users fall for this trap of phishing sites and share their personal and sensitive details. In this paper, we will analyze and implement machine learning (ML) techniques to detect phishing attacks. There are different methods to identify phishing attacks, one of them is by checking the uniform resource locator (URL) address using ML. ML is used to teach a machine to differentiate between phishing and original site URLs. There are many different techniques to overcome this attack. This research paper aims to provide accurate and true phishing detection with less time complexity. [ABSTRACT FROM AUTHOR]

Individuals and Organizations that rely on the Internet for communication, collaboration, and daily tasks regularly encounter security and privacy issues unless interventions of intelligent Cybersecurity defense systems have been made to counter them. The existing pieces of evidence reveal that phishing website attacks have drastically increased despite the scientific communities' best efforts to combat them. Based on the key research gaps explored, the study has made significant attempts to answer the following research questions: RQ#1: Which cross-validation techniques and model optimization parameters are appropriate for given datasets and classifiers? RQ#2: Which Classifier(s) yielded a superior Accuracy, F1-Score, AUC-ROC, and MCC value with acceptable train-test computational time before and after applying the Informative Feature Selection Techniques? RQ#3: What are the strengths and weaknesses of each Classifier after being applied with multiple Informative Feature Selection Techniques? RQ#4: Could the results of the top-performed Classifier and Informative Feature Selection Technique on Dataset one (DS-1) be consistent on Dataset two (DS-2)? The study used a Google Co-Lab environment and Python Code to conduct rigorous experiments. Our experimental findings reveal that the CAT-B Classifier demonstrated a superior phishing website detection performance in terms of (Accuracy, F1-Score, AUC-ROC, and MCC value with acceptable train-test computational time both before and after applying the UFS Feature Selection Technique by scoring 0.9764 accuracies, 0.9762 F1-Score, 0.996 AUC-ROC, and 0.9528 MCC Value with 6 Seconds train-test computational time. The study practically demonstrated implementing the CAT-B-UFS technique using a Python Code so that upcoming researchers can easily replicate their results and learn more. In future work, the study proposed implementing deep learning algorithms with proper feature selection techniques on Individual and Hybrid approaches to obtain more promising results. [ABSTRACT FROM AUTHOR]

This research delves into cybercrime in the post-truth era, where falsehoods are often masked as truths. This phenomenon, known as "talbis talbis," gives rise to illegal activities in the cyber world that exploit cybercrime scams such as phishing, pharming, sniffing, money mule, and social engineering. Despite being harmful, online fraud crimes are sometimes perceived positively by the public. Data from the Ministry of Communication and Information of the Republic of Indonesia in 2022 indicates that a majority of respondents have experienced online digital fraud, especially through fake gift schemes and illegal online loans. The Financial Illegal Activity Eradication Task Force (PASTI) has blocked illegal financial entities, including bogus investments and illegal online loans. Illegal investment crimes primarily rely on duplicating licensed entity websites, deceiving the public with promises of high returns. This study reveals the modus operandi of domestic illegal investment crimes and compares them with regulations governing foreign direct investment. The conclusion emphasizes the need for assertiveness from PASTI and the Investment Alert Task Force of the Financial Services Authority in supervising and providing legal protection for legal foreign direct investment activities in Indonesia. [ABSTRACT FROM AUTHOR]

This paper aims to provide an overview of social engineering attacks, and their impacts on cybersecurity, including national and international security, and figures out detection techniques, and major methods for countermeasure. How do social engineering attacks affect national and international security? And why is it so hard to cope with them? Seeking for answers to these questions, this paper applies qualitative research methods particularly literature review and case analysis. While qualitative research methods are predominantly employed, quantitative methods will also be utilized when deemed essential. Social engineering attacks, also referred to as online fraud, are a type of attack that typically necessitates minimal or no technical knowledge. Social engineering attacks, instead benefit from the weaknesses and mistakes of individuals, since the user is accepted as the weakest link in cybersecurity. Many studies have shown that the vast majority of successful cyber-attacks in the digital world are social engineering (SE) because countering them is more difficult than countering technical cyber-attacks. Based on the analysis of some major cyber-attacks such as the intervention in the 2016 US Presidential elections, the hacking of CIA director, John Brennan in 2015, and Stuxnet in 2010, the paper figures out that social engineering attacks have a tremendous impact on cybersecurity on the individual, institutional, societal, national, and international levels. Penetration tests and training for raising awareness are the prolific ways to mitigate social engineering attacks. [ABSTRACT FROM AUTHOR]

Young people are facing an ever-increasing array of online dangers. One of the most common is receipt of a phishing email. This paper presents new evidence on the characteristics of young people most likely to respond to such emails. I find approximately one-in-seven 15-year-olds are at risk of responding to a phishing email, rising to one-in-five amongst those from disadvantaged socio-economic backgrounds. Such risks are particularly high amongst young people with low levels of cognitive skill. Unfortunately, students who are taught about the dangers posed by phishing emails at school are just as likely to take inappropriate actions following their receipt as their peers who have not. I thus conclude that greater emphasis and higher quality instruction needs to be provided to young people about the online risks they face, particularly to those from disadvantaged socio-economic backgrounds and low academic achievers. [ABSTRACT FROM AUTHOR]

Phishing is an illegal act and security breach which acquires a user's confidential information without consent. Anti-phishing techniques used to detect and prevent such malicious acts to provide data safety to the end user. Researchers proposed an anti-phishing solution with the help of techniques like the blacklist record, heuristic function, visual similarity, and machine learning algorithm. In recent times many researchers proposed machine learning techniques for phishing detection and achieve more than 90% accuracy. However, there is reliability issue in the accuracy measures used by the researchers. In real life, the phishing dataset is unbalanced. Most of the researchers ignore this data quality during their research work design. In the case of unbalanced data, traditional accuracy measure does not give proper performance evaluation. It shows biased performance evaluations. In this paper, we experimented with an unbalanced dataset of phishing detection and did detailed result analysis to highlight the reliability issue of traditional performance evaluation measures for unbalanced data classification. We experiment with four classification algorithms and found that more than 90% of accuracy does not entitle any classifier as secure and safe if the dataset is unbalanced. Our work highlights the data factors and algorithmic limitations that compromise the system security and data safety. [ABSTRACT FROM AUTHOR]

The advancement in technology has led to increase in cyber‐attacks. Hackers have become more skilled at finding the loopholes in the system and can penetrate easily on to host network. The rate of cybercrimes is increasing exponentially with the growth of digital era. Phishing is considered as one of the top cybercrimes that has impacted the society at large. As per Kaspersky reports 2021, around 22% attacks were phishing attacks. This paper explores methods for detecting phishing uniform resource locator (URLs) by analyzing various features using Machine Learning techniques. Various data mining algorithms are used to learn data patterns that can identify and differentiate between benign and phishing websites using phishing website data set. The best results are shown by an XGBoost Model that provides more than 90% accuracy on the balanced class dataset. [ABSTRACT FROM AUTHOR]

Malicious uniform resource locators (URLs) are prevalent in cyberattacks, particularly in phishing attempts aimed at stealing sensitive information or distributing malware. Therefore, it is of paramount importance to accurately detect malicious URLs. Prior research has explored the use of deep-learning models to identify malicious URLs, using the segmentation of URL strings into character-level or word-level tokens, and embedding and employing trained models to differentiate between URLs. In this study, a bidirectional encoder representation from a transformers-based (BERT) model was devised to tokenize URL strings, employing its self-attention mechanism to enhance the understanding of correlations among tokens. Subsequently, a classifier was employed to determine whether a given URL was malicious. In evaluating the proposed methods, three different types of public datasets were utilized: a dataset consisting solely of URL strings from Kaggle, a dataset containing only URL features from GitHub, and a dataset including both types of data from the University of New Brunswick, namely, ISCX 2016. The proposed system achieved accuracy rates of 98.78%, 96.71%, and 99.98% on the three datasets, respectively. Additionally, experiments were conducted on two datasets from different domains—the Internet of Things (IoT) and Domain Name System over HTTPS (DoH)—to demonstrate the versatility of the proposed model. [ABSTRACT FROM AUTHOR]

Phishing attacks are evolving with more sophisticated techniques, posing significant threats. Considering the potential of machine-learning-based approaches, our research presents a similar modern approach for web phishing detection by applying powerful machine learning algorithms. An efficient layered classification model is proposed to detect websites based on their URL structure, text, and image features. Previously, similar studies have used machine learning techniques for URL features with a limited dataset. In our research, we have used a large dataset of 20,000 website URLs, and 22 salient features from each URL are extracted to prepare a comprehensive dataset. Along with this, another dataset containing website text is also prepared for NLP-based text evaluation. It is seen that many phishing websites contain text as images, and to handle this, the text from images is extracted to classify it as spam or legitimate. The experimental evaluation demonstrated efficient and accurate phishing detection. Our layered classification model uses support vector machine (SVM), XGBoost, random forest, multilayer perceptron, linear regression, decision tree, naïve Bayes, and SVC algorithms. The performance evaluation revealed that the XGBoost algorithm outperformed other applied models with maximum accuracy and precision of 94% in the training phase and 91% in the testing phase. Multilayer perceptron also worked well with an accuracy of 91% in the testing phase. The accuracy results for random forest and decision tree were 91% and 90%, respectively. Logistic regression and SVM algorithms were used in the text-based classification, and the accuracy was found to be 87% and 88%, respectively. With these precision values, the models classified phishing and legitimate websites very well, based on URL, text, and image features. This research contributes to early detection of sophisticated phishing attacks, enhancing internet user security. [ABSTRACT FROM AUTHOR]

Smishing is the delivery of phishing content to mobile users via a short message service (SMS). SMS allows cybercriminals to reach out to mobile end users in a new way, attempting to deliver phishing messages, mobile malware, and online scams that appear to be from a trusted brand. This paper proposes a new method for detecting smishing by combining two detection methods. The first method is uniform resource locators (URL) analysis, which employs a novel combination of the Google engine and VirusTotal. The second method involves examining SMS content to extract efficient features and classify messages as ham or smishing based on keywords contained within them using four well-known classifiers: support vector machine (SVM), random forest (RF), adaptive boosting (AdaBoost), and extreme gradient boosting (XGBoost). The best results of the proposed method were 98.5%, 96.9%, 93.1%, and 95.05% in terms of accuracy, precision, detection rate, and F1-score, respectively. Furthermore, the evaluation results of the proposed method outperformed the state-of-the-art and showed that the proposed method is effective in detecting smishing messages. [ABSTRACT FROM AUTHOR]

Security messages, as a form of information security awareness training, are designed to encourage individuals to make an informed security decision, reducing their susceptibility to online victimization. To date, no known study has assessed the effectiveness of security messages or whether the effectiveness of these messages varies based on the recipients' characteristics. Using a randomized controlled trial, this study tests the efficacy of security messages on reducing SMiShing victimization, then assesses whether thoughtfully reflective decision-making (TRDM) moderates the effect of these messages on victimization by launching simulated attacks against participants of the study. Findings reveal that neither security messages nor TRDM directly affect SMiShing victimization. However, security messages effectively prevent victimization when the message recipient has higher TRDM levels. The interaction between TRDM and security messages demonstrates the relevance of criminological theory and the importance of interdisciplinary scholarship in understanding how human behavior influences the effectiveness of cybersecurity practices. [ABSTRACT FROM AUTHOR]

In today's technologically advanced world, the escalating prevalence of phishing attacks necessitates an urgent exploration of effective countermeasures. This study delves into the crucial investigation of how self-regulation influences phishing susceptibility, while also examining the mediating role of information processing and the moderating influence of financial knowledge. A comprehensive survey was meticulously crafted, targeting 370 recent university graduates. The collected data underwent rigorous analysis using Hayes' PROCESS macro, unveiling a mediated moderation model. The findings reveal that self-regulation does not directly predict phishing susceptibility. However, information processing, whether systematic or heuristic, significantly impacts phishing susceptibility. Additionally, information processing serves as a mediator, connecting self-regulation to phishing susceptibility. Notably, the interaction between systematic information processing and financial knowledge emerged as a significant determinant of phishing susceptibility. By establishing a comprehensive mediated moderation model, this study provides invaluable insights for individuals and organizations seeking to bolster their defenses against phishing attacks. Furthermore, it emphasizes the vital role of financial knowledge and employees' heuristic information processing in mitigating cyber threats. This research serves as a crucial scientific contribution, offering compelling evidence that proactive management of contributing factors can effectively mitigate the escalating threats posed by phishing attacks. Plain language summary: Enhancing cybersecurity The crucial role of self-regulation, information processing, and financial knowledge in combating phishing attacks. [ABSTRACT FROM AUTHOR]

Phishing is a fraudulent tactic for attackers to obtain victims personal information, such as passwords, account details, credit card details, and other sensitive information. Existing anti-phishing detection methods using at the application layer and cannot be applied at the transport layer. A novel machine learning (ML) based phishing detection technique from transport layer security (TLS) 1.2 and TLS 1.3 encrypted traffic without decryption is proposed in this paper. Our proposed model detects phishing URLs at the transport layer and classifies them as legitimate or phishing. The features are extracted from TLS 1.2 and TLS 1.3 traffic, and phishing detection is performed using ML algorithms based on the extracted features. The datasets for legitimate and phishing sites are created using features derived from TLS 1.2 and TLS 1.3 traffic. According to the experimental results, the proposed model effectively detects phishing URLs in encrypted traffic. The proposed model achieves an accuracy of 93.63% for Random Forest (RF), 95.07% for XGBoost (XGB), and the highest accuracy of 95.40% for Light GBM (LGBM). [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) enables day-to-day objects to connect with the Internet and transmit and receive data for meaningful purposes. Recently, IoT has resulted in many revolutions in all sectors. Nonetheless, security risks to IoT networks and devices are persistently disruptive due to the growth of Internet technology. Phishing becomes a common threat to Internet users, where the attacker aims to fraudulently extract confidential data of the system or user by using websites, fictitious emails, etc. Due to the dramatic growth in IoT devices, hackers target IoT gadgets, including smart cars, security cameras, and so on, and perpetrate phishing attacks to gain control over the vulnerable device for malicious purposes. These scams have been increasing and advancing over the last few years. To resolve these problems, this paper presents a binary Hunter–prey optimization with a machine learning-based phishing attack detection (BHPO-MLPAD) method in the IoT environment. The BHPO-MLPAD technique can find phishing attacks through feature selection and classification. In the presented BHPO-MLPAD technique, the BHPO algorithm primarily chooses an optimal subset of features. The cascaded forward neural network (CFNN) model is employed for phishing attack detection. To adjust the parameter values of the CFNN model, the variable step fruit fly optimization (VFFO) algorithm is utilized. The performance assessment of the BHPO-MLPAD method takes place on the benchmark dataset. The results inferred the betterment of the BHPO-MLPAD technique over compared approaches in different evaluation measures. [ABSTRACT FROM AUTHOR]

Security in the blockchain has become a topic of concern because of the recent developments in the field. One of the most common cyberattacks is the so-called phishing attack, wherein the attacker tricks the miner into adding a malicious block to the chain under genuine conditions to avoid detection and potentially destroy the entire blockchain. The current attempts at detection include the consensus protocol; however, it fails when a genuine miner tries to add a new block to the blockchain. Zero-trust policies have started making the rounds in the field as they ensure the complete detection of phishing attempts; however, they are still in the process of deployment, which may take a significant amount of time. A more accurate measure of phishing detection involves machine-learning models that use specific features to automate the entire process of classifying an attempt as either a phishing attempt or a safe attempt. This paper highlights several models that may give safe results and help eradicate blockchain phishing attempts. [ABSTRACT FROM AUTHOR]

One of the most common cyber-attacks that users encounter on the internet are phishing websites. In the attacks that are performed on phishing websites, real websites are duplicated and published on different domain names, and users are directed to these fake websites through various social engineering techniques. Through to the website to which users are directed, they transmit some personal and confidential data such as credit card, username-password details to attackers. In this study, the establishment of the infrastructure and content of phishing internet sites has been explained, a tool named PhisherHunter created, and four different methods have been developed so as to detect such websites. Through the examination of newly registered websites, which is the main detection method, a successful detection rate of 95.4% has been achieved. Three different methods have been used in the active defense part of the study. Firstly, the hosting company has been automatically determined to stop the publication of the phishing website and a notification has been sent with a success rate of 98%. As the second active defense method, the active honeypot technique has been developed. The active honeypot method aims to enter a marked information on the phishing website and to track this information on the real website. And as the last active defense method, the method of poisoning phishing websites by using fake data has been developed. It has been observed that poisoning methods by using the techniques of active honeypot and fake data have achieved a success of 92%. [ABSTRACT FROM AUTHOR]

Phishing is one of the most dangerous threats in which a hacker imitates a person, company or government agency to lure and deceive their victims. Machine learning anti-phishing solutions are gaining popularity nowadays. However, most anti-phishing solutions rely heavily on features extracted from third-party services such as whois services, DNS search, and web traffic. As a result, they are slow and require a lot of computing resources. This paper introduces a machine-learning-based framework: Phish-Sight that detects phishing websites through a visual inspection strategy. Phish-Sight uses dominant color features and highly targeted popular brand names embedded in URLs' web pages with machine learning techniques to detect phishing web pages. Prediction performance of the dominant color features and popular brand names from web pages was investigated using five machine learning algorithms. The Random Forest algorithm surpassed the others, with a 98.43% true positive rate and 99.13% accuracy in detecting phishing frauds. The prediction run time per web page measured at 7.6 s suggests that Phish-Sight has potential for real-time applications. [ABSTRACT FROM AUTHOR]

Smishing is a cybercriminal attack targeting mobile Short Message Service (SMS) devices that contains a malicious link, phone number, or email. The attacker intends to use this message to steal the victim's sensitive information, such as passwords, bank account details, and credit cards. One method of combating smishing is to raise awareness and educate users about the various tactics used by SMS phishers. But even so, this method has been criticized for becoming inefficient because smishing tactics are continually evolving. A more promising anti-smishing method is to use machine learning. This paper introduces a number of machine learning algorithms that can be used for detecting smishing. Furthermore, the differences and similarities among them as well as the pros and cons of each are presented to support future research into more effective anti-smishing solutions for securing mobile devices from cyber criminals. [ABSTRACT FROM AUTHOR]

Phishing is an identity theft that employs social engineering methods to get confidential data from unwary users. A phisher frequently attempts to trick the victim into clicking a URL that leads to a malicious website. Many phishing attack victims lose their credentials and digital assets daily. This study demonstrates how the performance of traditional machine learning (ML)-based phishing detection models deteriorates over time. This failure is due to drastic changes in feature distributions caused by new phishing techniques and technological evolution over time. This paper explores continual learning (CL) techniques for sustained phishing detection performance over time. To demonstrate this behavior, we collect phishing and benign samples for three consecutive years from 2018 to 2020 and divide them into six datasets to evaluate traditional ML and proposed CL algorithms. We train a vanilla neural network (VNN) model in the CL fashion using deep feature embedding of HTML contents. We compare the proposed CL algorithms with the VNN model trained from scratch and with transfer learning (TL). We show that CL algorithms maintain accuracy over time with a tolerable deterioration of 2.45%. In contrast, VNN and TL-based models' performance deteriorates by over 20.65% and 8%, respectively. [ABSTRACT FROM AUTHOR]

In the increasingly complex domain of Korean voice phishing attacks, advanced detection techniques are paramount. Traditional methods have achieved some degree of success. However, they often fail to detect sophisticated voice phishing attacks, highlighting an urgent need for enhanced approaches to improve detection performance. Addressing this, we have designed and implemented a novel artificial neural network (ANN) architecture that successfully combines data-centric and model-centric AI methodologies for detecting Korean voice phishing attacks. This paper presents our unique hybrid architecture, consisting of a 1-dimensional Convolutional Neural Network (1D CNN), a Bidirectional Long Short-Term Memory (BiLSTM), and Hierarchical Attention Networks (HANs). Our evaluations using the real-world KorCCVi v2 dataset demonstrate that the proposed architecture effectively leverages the strengths of CNN and BiLSTM to extract and learn contextually rich features from word embedding vectors. Additionally, implementing word and sentence attention mechanisms from HANs enhances the model's focus on crucial features, considerably improving detection performance. Achieving an accuracy score of 99.32% and an F1 score of 99.31%, our model surpasses all baseline models we trained, outperforms several existing solutions, and maintains comparable performance to others. The findings of this study underscore the potential of hybrid neural network architectures in improving voice phishing detection in the Korean language and pave the way for future research. This could involve refining and expanding upon this model to tackle increasingly sophisticated voice phishing strategies effectively or utilizing larger datasets. [ABSTRACT FROM AUTHOR]

Email phishing is a serious and potentially catastrophic threat to organisations and individuals. Understanding what factors may influence individual susceptibility to phishing attacks is essential to protecting against cybercrime. We investigated the potential interplay between conscientiousness and cue utilisation in individuals’ ability to accurately differentiate between phishing and legitimate emails. University students (N = 255) completed a phishing detection task, the Mini International Personality Item Pool, and the phishing edition of the Expert Intensive Skill Evaluation (2.0) battery. After, they were sent simulated phishing emails to their student email address. A Signal Detection Theory approach revealed that higher cue utilisation was associated with a greater ability to tell whether an e-mail was phishing or not in the detection task. For the simulated phishing emails, participants with lower conscientiousness were more likely to click an embedded link in an unsophisticated phishing email, however cue utilisation had no association with email engagement in a naturalistic setting. The findings provide insight into why some people are more susceptible to phishing scams and reveal important differences in phishing sensitivity as a function of context, which has implications to interventions. [ABSTRACT FROM AUTHOR]

Higher education institutions (HEIs) are highly susceptible to cyberattacks, particularly those facilitated through phishing, due to the substantial volume of confidential student and staff data and valuable research information they hold. Despite federal legislations focusing on bolstering cybersecurity for critical institutions handling medical and financial data, HEIs have not received similar attention. This Note examines the minimal obligations imposed on HEIs by existing federal and state statutes concerning data breaches, the absence of requirements for HEIs to educate employees and students about phishing attacks, and potential strategies to improve student protection against data breaches. [ABSTRACT FROM AUTHOR]