Field of the Invention
The present invention generally relates to the field of cyber security. More specifically, the present invention relates to a method and algorithm that detect phishing emails based on natural language processing techniques.
Description of the Related Art
The Internet has become an integrated part of our working or daily lives. With more and more sensitive formation for personal, business or even national security made accessible online, cyber security solutions have one of the most serious issues in the society.
Among various cyber security issues, phishing attacks are one of the most dangerous types. In general, phishing refers to a social engineering threat that aimsatgleaning sensitive information from unsuspecting victims. Phishing attacks are usually carried out via communication channels such as email or instant messaging by “attackers” posing as legitimate and trustworthy entities.
Consequently, many research groups have studied phishing detection from various perspectives including server-side and browser-side strategies, education/training, and evaluation of anti-phishing tools, detection schemes, and studies that analyze the reasons behind the success of phishing attacks.
There are essentially two primary classifications of phishing detection schemes. The first type refers to schemes that detect phishing based on analyzing content of the target web pages, i.e. analyzing the web pages whose links are within the email. The second type are schemes that operate directly on the content of the emails.
The schemes for detecting phishing attacks (email and web pages) in the literature can be broadly classified into three categories comprising schemes based on information retrieval, machine learning based techniques, and string, pattern and visual matching based detection schemes.
A typical approach to detect phishing using web page content is analyzing the structure of the URLs and validating the authenticity of the content of these target web pages. One such scheme is based on information retrieval and text mining algorithms. Other researchers studied detecting phishing web pages based on visual similarity and on using watermarking techniques to thwart phishing.
Furthermore, some current schemes identify phishing URLs by analyzing only the structure of the links and not the content of the target web pages. Some features are described that can be used to distinguish a phishing URL from that of a benign URL. These features are used to detect phishing URLs. For example, an algorithm is made available, which uses the phishing data provided by the anti-phishing working group (APWG) to extract generic characteristics of hyperlinks embedded in phishing emails.
Moreover, there are phishing detection schemes at the email level, which use machine-learning techniques on a feature set. In general, a classifier is trained on a set of features extracted from the email. After the training, this classifier is used to detect phishing emails from the email stream. Some of the common features are: presence or absence of JavaScript, HTML/plain-text email, IP addressed URLs, number of links/domains/dots, etc. However, for machine learning phishing detection scheme, these filters need to be updated on a regular basis.
One current scheme employs a heuristic algorithm that performs simple header, link and a cursory text analysis (scanning for the presence of certain text filters) of incoming emails. Some researchers have studied the evolution of phishing email messages and developed a classification of phishing messages into two groups: flash and non-flash attacks, and classify phishing features into transitory and pervasive. However, both methods lack of accuracy due to simplified analysis process. A study conducted on the anatomy of phishing emails used a database of fraudulent emails received by the associated organization in an effort to understand the structure of a phishing email in addition to unraveling the most common tricks used by phishers.
Therefore, there is a recognized need in the art for a phishing detection method that does not need frequently updating filters, and that can accurately determine phishing emails without the need to visit the potential phishing websites. Particularly, the previous art is deficient in this aspect. The present invention fulfills this long-standing need and desire in the art.