Classification of Phishers

Dantu Ram, Palla Srikanth and Cangussu Joao
Additional contact information
Dantu Ram: University of North Texas
Palla Srikanth: University of North Texas
Cangussu Joao: University of Texas at Dallas

Journal of Homeland Security and Emergency Management, 2008, vol. 5, issue 1, 16

Abstract: Phishing attackers masquerade as genuine senders and try to steal consumers' personal identity data and financial account credentials. In spite of aggressive efforts, technology companies have had limited success in restricting phishing attacks. Unfortunately the nature of phishing attacks changed over time from passive, such as password guessing and eavesdropping to active attacks, such as employing Trojans to intercept traffic and adopting social engineering techniques. No matter how many authentication techniques we develop, phishers always adapt. However, phishers cannot become part of the recipient's social network without consent. Though they can forge certain fields in an email header, phishers do not have access to the complete header. In this paper, we describe techniques for detecting phishers based on their traffic paths, traffic patterns, and on the receivers' social network. Considering such issues, we based our solution on the trustworthiness of the relays participating in routing the emails. We examine the email's header rather than the content. We designed our classifier to perform the following analyses in four steps: i) DNS-header analysis, ii) Social network analysis, iii) Wantedness analysis, and iv) Proactive classification. We classify phishers into: i) Serial phishers, ii) Recent phishers, iii) Prospective phishers, and iv) Suspects. Finally, our classifier appends an alert level or label to the email's "subject" before adding the email to the inbox.

Keywords: network security; spam; phishing; application security (search for similar items in EconPapers)
Date: 2008
References: Add references at CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://doi.org/10.2202/1547-7355.1393 (text/html)
For access to full text, subscription to the journal or payment for the individual article is required.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:bpj:johsem:v:5:y:2008:i:1:p:16:n:12

Ordering information: This journal article can be ordered from
https://www.degruyter.com/journal/key/jhsem/html

DOI: 10.2202/1547-7355.1393

Access Statistics for this article

Journal of Homeland Security and Emergency Management is currently edited by Irmak Renda-Tanali

More articles in Journal of Homeland Security and Emergency Management from De Gruyter
Bibliographic data for series maintained by Peter Golla ().