Machine Learning Techniques for Detecting Phishing URL Attacks

1  Introduction

The internet is a wealthy source of social media applications [1]. Boyd et al. in 2007 proposed the definition of Online Social Networks (OSNs) [2]. OSNs applications varied from Mobile-Based and Web-Based that permit User-Generated content [3]. OSNs and Cyber-Physical systems are rapidly increasing. OSNs applications like LinkedIn, Pinterest, Whatsapp, Facebook, and Twitter are important for communication with others via links with other members with common interests in the cloud despite thinking about geographical distances [4]. OSNs are not just for communication and continuous knowledge of the latest opinions and stories about any digital topic around the globe via the network [5]. In addition, they enhance E-Business by providing advertisements and promotions [6]. In recent years, a large number of Facebook attacks have been reported [7]. Irresponsible use of OSNs and ignorance of pinholes of phishing attacks cause constantly increasing attacks. Cybercriminals may attack users by getting their account information or contact phishing through spamming [8].

Cyber-Security is the standard used to block any attacks on systems [9]. Improving Cyber-Security and securing personal information have become one of the biggest challenges in the world. When the development of new web technologies like cloud computing, mobile computing, E-Commerce, net banking, etc., it is necessary to think about how to protect users. Governments think about “Cyber-Crimes" which are increasing in daily activities and creating attack pinholes for attackers to exploit [7,8]. Organizations interested in privacy and Cyber-Security are aware of their data and any new threats [4]. Despite the continuing effort of organizations to avoid Cyber-Security breaches and Cyber-Attacks, it is unavoidable because of successful attacks and their huge loss, and the effectiveness of Cyber-Security of networks becomes an essential issue. Ernst & Young reported that “Mobilization, virtualization, and cloud technology have created new technologies and opportunities in the business, making it more vulnerable to Cyber-Attacks” [10].

Recently, after the rise of the Internet of Things, the Cybercrime problem has increased greatly, which is considered a big challenge in the information technology field [9,11,12]. Cyber-Security protects organization assets against cybercriminals attack which may occur because of human error, planned attack, or the computer system limitation [10]. There is essential to identify malicious users when socializing over OSNs, as they may utilize camouflage and phishing techniques that cheat users into revealing their sensitive information [13]. There are many types of attacks used to acquire the personal information of people. As a result of the awareness lack, malicious content could be an executable, virus, javascript code, malware, adware, shell scripts, bat files, or set of commands via phishing sites, financial scams that trick people to buy products or take part in lucky events games [14].

In recent years, Internet users are insecure because of Web-Threats from social networks like social botnets. It is a collection of social users that convince users to release their personal information via malicious activities [15]. OSNs help in connecting people with similar interests and builds social relations. This leads to the availability of an enormous amount of users’ information which attracts malicious users to open the way for criminals, perform undesired activities like phishing and identity theft, and begin attacks to access this information and violate the privacy of the users [5].

With the progress of network technology and the development of networking applications, security issues have become at risk. Phishing websites are capable of avoiding detection by looking legitimate which attracts these users to use these sites [16–19]. Phishing attacks are more and more complicated and make threats to people’s network environments. The harm of phishing websites grows rapidly by increasing the number of fake messages which spread malicious information via visits to malicious Uniform Resource Locators (URLs) [14]. Organizations provide many social networking services to protect from these attacks by detecting phishing websites [16]. A chrome extension is a tool that can protect users from falling prey to malicious URLs activities [14].

Cyber-Security researchers and domain experts use Machine learning (ML) algorithms to build Anti-Phishing detectors models which can be applied in a Real-Time environment and interpret the results to defend against multimedia application attacks [20,21]. The major contribution of this study is listed as follows. Presenting a survey on the most common approaches utilized for detecting phishing attacks. Applying Machine Learning models NN, NB, and Adaboost to determine the accuracy, sensitivity, precision, specificity, and F-score for the applied Kaggle dataset that represents URL phishing attacks.

The rest of the paper is structured as follows. Section 2 introduces social engineering and the life cycle of a social engineering attack. Section 3 describes social network attacks. The Anti-Phishing solutions are explained in Section 4. The Cyber-Security techniques to subdue attacks are introduced in Section 5. The limitation and threads are investigated in Section 6. Finally, the conclusion is given in Section 7.

2  Social Engineering

SE is a developed threat via different web applications. In the cyber domain, the human factor is more critical than the technical aspect. 95% of attacks are daily caused by human errors like providing personal information [22]. The attacks cause more and more economic losses. Mouton et al. have clarified SE as “The science of using social interaction have a way to convince others to respond with an attacker request” [5]. SE attacks are carried out in several phases with malicious activities as in Table 1.

Because of the rapid development of SE incidents, SE researchers confirm that there is no helpful defense method against these attacks [23]. Jamil et al. suggested a cycle framework for SE attacks [22]. The Life Cycle of a SE attack consists of six phases as described in Fig. 1.

Figure 1: SE attacks life cycle

Traditional SE attacks, like phishing, do not require lots of knowledge to occur, so they are the reason for hundreds of millions in economic losses. Phishing attacks have globally increased by 1,220,523 in 2016 when compared with the preceding year. An appropriate SE framework contributes to the defense against SE attacks by illustrating the relationships between attack components [24].

3  Social Network Attacks

Cyber-Security is a critical issue in different industries as it causes enormous economic and reputation loss the in the majority of organizations [25]. In a cyberspace environment, through unapproved access to a PC, a threat uses words or images to steal sensitive information of others and produce serious damage by attacking different resources [26]. Limited knowledge of Cyber-Attacks features harmed victim organizations in all business sectors. The general social network Cyber-Attack and techniques in Cyber-Crimes have been identified in Table 2 [5].

According to the Kaspersky Lab Global IT Risk Review, half of the business threats are cyber threats. Remote attacks increase Cyber-Attacks as they allow attackers to attack any PC anytime anywhere around the globe. RAKKSSA framework provides safety guidelines to reduce the risk of Cyber-Attacks and protect the organization's information. Cyber threat intelligence can provide a timely reply to attacks [10]. To secure the data processing for IoT middleware systems Ayoade et al. [27] presented an effective methodology to tackle the process of attacker authentication. Moreover, an architecture for developing crawling websites using DNN is presented by ElAraby et al. [28].

3.1 Social Networks Phishing Attacks

In social sites, a phishing attack is the most serious Cyber-Attack [5] that could cause destructive losses [26]. It is the most critical aspect of threats to internet security. As online daily transactions occur, much, this attack is Easy-to-Use on SE [29].

Phishing is a malicious technique for stealing others’ data ethically and technically. Attackers contact people via different channels in social media [30]. Users drop into the trap of a phishing site, because of their ignorance enough knowledge about the URLs in security. As a result of the increasing reliance of individuals on cyberspace, the generation of digital information increases exponentially and the severity level of attack vectors increases continuously [26].

For the past two years, the Anti-Phishing working group detected about 97.36% of phishing websites. Security companies provide solutions for users to manage malicious activities. PhishMe develops software for organization security workers to deal with phishing attacks just by clicking on a button provided in the E-Mail client Add-in [31].

3.2 The Ecosystem of Phishing Attack Process

The ecosystem of the phishing attack process assumed that the victim receives a phishing email for instance with a fake link by the attacker and the attacker deals with a queue of phishing websites. These websites receive fake hosting and send sensitive data collection from the phasing dataset from the attackers. Mihai [32] suggest that the attack starts with showing a web service via a tricky HTTP form with a popular interface. This form contains a tricky link for the website, which the attacker hosts to collect the user’s data. When the victim uses this link and interacts with the form by entering the required data, the data becomes under the control of the attacker [33] as clarified in Fig. 2.

Figure 2: Traditional phishing process

3.3 Phishing Attacks Types

Spear Phishing (SP) is an attack that may be directed to steal the users’ information from a specific company website. It is helpful by knocking towards intrusion in the system. While Clone Phishing (CP) is the attack here that depends on cheating victims by making an identical copy of the legal website in which the trap is made by attackers. Otherwise, Whaling Phishing (WP) is a Cyber-Attack similar to spear Phishing, but it targets High-Profiles [29,30].

4  Anti-Phishing Solutions

The detective technique is the most significant as it can reduce human errors by filtering and blocking access to phishing URLs that have installed kits. It is observable that using a combination of hiding techniques may delay the detection of the site for up to ten hours. The preventive technique introduced by Well-Built authentication. A corrective technique introduced by like site removal [33].

4.1 Phishing Detective Technique Approaches

4.1.1 Software Grouping Approaches

This strategy distinguishes phishing and authentic sites by depending on programming devices that secure and differentiate attacks [34]. Table 3 shows different methodologies for phishing programming detection.

4.1.2 User Preparing Approaches

These approaches depend on users’ awareness and their ability to differentiate between phishing and authentic sites by improving their understanding of malicious assault [29].

4.2 Cyber Security Techniques to Subdue Attacks

To protect user accounts, researchers provide guidelines for securing accounts [35]. First, we used access control which is one of the basic cybersecurity measures in protecting information with a username and password. Second, data authentication, in which the antivirus’s duty is to evaluate the validity of the incoming documents and decide whether their source is trustworthy or not. Finally, a firewall is software that examines whether messages are being entered or left online and filters those that do not satisfy security criteria, therefore assisting in the detection of hackers [36].

5  Discussion

Phishing is a deceptive attempt to get sensitive information in which attackers are always finding new ways to trick clients using social networking tactics by persuading them to follow instructions in a flow [37]. Anti-phishing Machine Learning (ML), Deep Learning (DL), scenario-based, and hybrid algorithms have all been created in recent years to detect phishing attacks, and they are continually improving. The finest outcomes come from machine learning approaches. DL and NLP techniques are quickly improving to track the URLs as text and to extract the character-level or word-level to feed DL models to identify the phishing URL websites. However, phishing website detection technologies continue to confront a number of challenges and limitations [38].

The Collection of URLs websites contains numerous validated phishing URLs, such as the phishtank-dot-com website, as an alternative. The drawback is that it necessitates an additional feature extraction process based on rules, and it is reliant on third-party services. This approach is independent of third-party services and unnecessary specialist knowledge; however, the learning process will take longer. It’s simple to start using published datasets like the UCI machine learning dataset for the training process in academic articles, especially for complicated structured models like multi-layer neural networks [37]. Anti-phishing has been around for decades, and various efficient approaches have been developed. Attack techniques, on the other hand, are always developing, and no one-size-fits-all solution exists. It is worthwhile for us to continue investigating phishing website detection in order to protect against phishing attacks and minimise financial losses [38]. As indicated in Table 4, we compare various machine learning and deep learning models utilized by state-of-the-art studies in this part [39–60].

Machine learning models based on Neural Network (NN), Adaboost, and Naïve Bayes (NB) are utilized in this work to investigate the detection of phishing attacks using a dataset found on the Kaggle website “https://www.kaggle.com/code/maoryatskan/website-phishing-v2/data”. The dataset is accessible in both text and CSV formats, and it includes the following resources that can be used as inputs for model construction: A database of website URLs for over 11000 websites. Each sample comprises 30 website parameters and a class label indicating whether or not it is a phishing website (1 or −1). The data collection is also used as input for project scoping, attempting to describe functional and non-functional needs. Fig. 3 and Table 5 show the results obtained representing the accuracy, precision, sensitivity, specificity, and F1-score of the proposed ML (NN, NB, and Adaboost) models [61,62].

Figure 3: The results of the proposed ML (NN, NB, and Adaboost) models

6  Limitation

The major limitation of the current efforts to detect phishing attacks can be concluded in the following points. The preprocessing of data enrolled from the applied URL websites including imputation, and normalization should be performed before feature selection and extraction, especially for large-scale datasets. Due to the variability and change of URL information including the updated version, IP setting, or any other criteria. Therefore, the need to maintain and track the change should be simultaneously performed to tackle any new attacks and detect phishing attacks. In addition, the training period is lengthy. The model is indifferent whether the website’s URL is active or contains an error. Short links, sensitive phrases, and phishing URLs that do not replicate other websites will be misclassified by the system.

7  Conclusion

Phishing is a serious security concern. It has a significant impact on the economic and online shopping sectors. Because online applications are a crucial interface for accessing and configuring user data, improper use of the web opens the door to targeted assaults by phishers who choose websites that are aesthetically and semantically identical to legitimate websites. Securing the online interface necessitates solutions that address dangers posed by both technological and social vulnerabilities. In the field of secure computing, preventing phishing attacks is a top goal and a serious difficulty. In this paper, we have presented comparative research for multiple classifiers to improve webpage security by detecting phishing websites by inspecting URLs. Machine learning techniques are a formidable defense and have a high learning capacity for making online message recipients aware of attacks and fraudulent websites. It can determine whether a website is safe or a phishing one. We can use detection approaches to check properties such as datasets, feature extraction and detection algorithms, and performance evaluation metrics as prevention tools. Attackers frequently overcome existing phishing defense methods based on URLs or page contents. The results of the paper investigated that the accuracy achieved was 90.23%, 92.97%, and 95.43% using NN, NB, and Adaboost ML models which indicates the reliability and robustness of the proposed method compared with the state-of-the-art methods.

Funding Statement: This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

Availability of Data and Materials: A data availability found at https://www.kaggle.com/code/maoryatskan/website-phishing-v2/data.

Conflicts of Interest:: The authors declare that they have no conflicts of interest to report regarding the present study.