Isredza Rahmi A HAMID¹, Jemal ABAWAJY¹, Tai-hoon KIM^2
1 School of Information Technology, Deakin University,
Waurn Ponds, VIC., 3217, Australia,
iraha@deakin.edu.au, Jemal@deakin.edu.au
² School of Computing and Information Science, University of Tasmania,
Centenary Building, room 350, Private Bag 87 Hobart TAS 7001
(Corresponding Author)
taihoonn@empas.com

Abstract: Email has become the critical communication medium for most organizations. Unfortunately, email-born attacks in computer networks are causing considerable economic losses worldwide. Exiting phishing email blocking appliances have little effect in weeding out the vast majority of phishing emails. At the same time, online criminals are becoming more dangerous and sophisticated. Phishing emails are more active than ever before and putting the average computer user and organizations at risk of significant data, brand and financial loss. In this paper, we propose a hybrid feature selection approach based on combination of content-based and behaviour-based. The approach could mine the attacker behaviour based on email header. On a publicly available test corpus, our hybrid features selection is able to achieve 94% accuracy rate.

Keywords: Internet Security, Behavior-based, Feature Selection, Phishing.

>>Full Text
CITE THIS PAPER AS:
Isredza Rahmi A HAMID, Jemal ABAWAJY, Tai-hoon KIM, Using Feature Selection and Classification Scheme for Automating Phishing Email Detection, Studies in Informatics and Control, ISSN 1220-1766, vol. 22 (1), pp. 61-70, 2013. https://doi.org/10.24846/v22i1y201307

Introduction

Phishing emails have become common problem in recent years. According to Islam and Abawajy [22], “phishing attacks continue to pose serious risks for consumers and businesses as well as threatening global security and the economy”. This calls for the development of effective countermeasures against email-born phishing attacks in order to safeguard critical infrastructures such as banking

Phishing is a type of semantic attack in which victims are sent emails that deceive them into providing sensitive information such as account numbers, passwords, or other personal to phisher. Normally, phishers send a large number of fake e-mails pretending to be from a legitimate and well-known business organization. Generally, the email content insists the victim to update personal information to avoid losing access rights to services provided by the organization.

Unfortunately, they lure user to a bogus web site implemented by the attacker. According to Anti-Phishing Working Group phishing trend report, the number of phishing attacks through email increased from about 170000 in 2005 to about 440000 in the 2009 [2]. Based on Gartner survey, approximately 109 million U.S adults have received phishing e-mail attacks with average loss per victim estimated to be $1,244.

Phishing email detection has drawn a lot of considerations from many researchers. Several good anti-techniques such as content-based [6], [11], [16] and behavior-based [7], [5], [13] have been developed to address the phishing problems. However, phishing attacks have continued to be a serious problem. This is because phishing has become more and more complicated and the phishes continually change their ways of perpetrating phishing attack to defeat the anti-phishing techniques. Moreover, most phishing emails are nearly identical to the normal email. Therefore existing anti-phishing techniques such as content-based approach are not able to curb phishing attacks. Furthermore, most of the existing emails filtering approaches are static where it can easily be defeated by modifying contents of emails and link strings.

In this paper, we present an approach to detect phishing email using hybrid features that combine content-based and behaviour-based approaches. The main objective of this paper is to identify behaviour-based features in phishing emails which cannot be disguised by an attacker. By analyzing attacker’s pattern, it is observed that phishing email that has a tendency to come from more than one domain could indicate abnormal activity.

Domain server that handles more than one type of domain email could show abnormal email as well. This information is done by analyzing email header which is usually neglected by others. We considered analyzing the message-ID tag and sender email in order to mine the attacker’s behaviour. This study applies the proposed hybrid feature selection to 6923 datasets which come from Nazario [14] phishing email collection ranging from 2004 to 2007 and SpamAssassin [17] as ham emails.