Email phishing: text classification using natural language processing

Phishing attacks are one of the emerging and devastating cyber-attacks. Email is now considered as an appropriate means of written correspondence. Phishing emails are emails intended to extract sensitive and confidential information from the receiver. Two prong presentations are the aims of this paper; first, the analysis to remove the Phishing features from the email, and second, a notable triumph to reduce the complex data set to a lower dimension with different features. The feature reduction process is based on classification and prediction accuracy. The training and testing dataset is a collection of 1500 data tuples from the SPAMASSASIAN corpus. The validation dataset is made by retrieving the emails from Gmail users. To decide the two class codes, PHISHING and HAM, a total of 2000 emails are used to train, test, and validate the data tuples. In this research, 1000 emails are used to train, 500 emails are used to test the data tuples and validate them. First, the dataset is preprocessed to parse the data using HTML Parsing, Data Cleaning, Stemming, Stop Word Elimination, and Tokenization. By reading each email iteratively from the dataset, the features are extracted. Classifier ensemble strategies have gained the attention of many researchers in the machine learning research community in recent years []. Three machine learning classification algorithms are applied to predict the PHISHING and HAM emails such as decision trees (J48), random forest, and logistic regression. It was found that the random forest algorithm works best to separate PHISHING and HAM emails with the precision of a 99% classifier. With 15 feature sets, it fits best, the accuracy of training and validation is calculated to be 95.6% and 99.4%, respectively.

This chapter discusses the concept of natural language processing (NLP), specifically how the NLP is applied. The chapter further outlines the typical functions of the NLP. In addition, it explores the NLP in strategy and strategy implementation.The NLP is a branch of computer science, AI and linguistics that focuses on the interaction between computer programs and human language. There are three functions of the NLP, namely, machine translation (MT), text summarisation and sentiment analysis (SA). MT is a branch of computer linguistics that analyses the use of computerised tools to translate the context derived from this, from one language to the next. The language that is being translated is the human language.Automatic text summarisation refers to a process of bringing about a succinct and meaningful summary of the text. SA is a way of finding out the polarity or strength of the opinion that is expressed in written text. The opinion could be either positive or negative. MT has three major approaches, namely, rule-based MT, statistical MT and neural MT. A rule-based system would typically require the expert to know both the source and the target languages. This knowledge is then used to develop syntactic, semantic and morphological rules to achieve the translation. The statistical approach uses statistical models based on the analysis of bilingual text corpora. The neural MT approach uses neural networks to achieve machine translation. There are two broad categories of text summarisation approaches, namely, extractive summarisation and abstractive summarisation. Furthermore, there are four popular types of SA, namely, the fine-grained SA, emotion detection, aspect-based SA and multilingual SA. The firm that deploys the NLP and ML in Big Data Analytics would gain crucial and better insights, setting the firm apart from its competitors.

Emails are the simplest way to communicate between users. But increasing rate of cybercrime activities require shrewd use of email. Phishing email is one of the most perilous threats nowadays. Through phishing email, attackers want to steal the sensitive information of the email users. This sensitive information includes username, password, credit card details etc. These may cause excessive financial loss. Many anti-phishing methods exist in literature to detect phishing emails. But criminals use new methods day by day, which causes challenge to build anti-phishing methods to prevent phishing emails. In this paper the performance of two deep learning models for detection of phishing email have been compared. The first model uses convolution neural network with Global Vector (GloVe) word embedding where Bidirectional Encoder Representations from Transformers (BERT) model with fine tuning has been used in second model. The proposed method detects the phishing email by analyzing the content of the email. Some widely used datasets (lingSpam, enronSpamSubset, completeSpamAssassin, Jose Nazario's phishing dataset and Enron email dataset) are merged together and applied to measure the performance of the model. It is found that the GloVe word embedding achieves better accuracy (98%) than BERT model (96%) in detection of phishing emails in the present context.

Rapid growth in technology has opened up wide means of communication. Electronic mail was a great contribution in the field of communication. Emails played the role of a valuable communication medium for all the internet users in the world. Phishing emails are spreading like an infectious disease nowadays. It results in economic losses and wastage of time of email users. Different kinds of phishing emails have been reported for this time. Many approaches have been developed in order to counteract this problem. In this paper, a model for phishing detection, which is based on the combination of linguistic techniques along with the machine learning technique is proposed. This paper also presents an overview of the main approaches developed with the aim of detecting and thereby filtering phishing emails and this work is done with the aid of a wide range of papers published in this field. Keywords: Anti-phishing; Client side defenses; Machine Learning; Phishing; Server side defenses.

Software Development Life Cycle (SDLC) starts with eliciting requirement of user as a document called Software Requirement Specification (SRS). SRS document is mostly written in the form of any natural language (NL) that is convenient for the client. In order to develop a right software based on user's requirements, the objects, methods and attributes needs to be identified from SRS document. In this paper, an attempt is made to develop a methodology, using the concept of Natural Language Processing (NLP) for Object Oriented (OO) Programming System analysis concept, by finding out the class name and its details directly form SRS.

Every electronic message poses some threat of being a phishing attack. If recipients underestimate that threat, they expose themselves, and those connected to them, to identity theft, ransom, malware, or worse. If recipients overestimate that threat, then they incur needless costs, perhaps reducing their willingness and ability to respond over time. In two experiments, we examined the appropriateness of individuals’ confidence in their judgments of whether email messages were legitimate or phishing, using calibration and resolution as metacognition metrics. Both experiments found that participants had reasonable calibration but poor resolution, reflecting a weak correlation between their confidence and knowledge. These patterns differed for legitimate and phishing emails, with participants being better calibrated for legitimate emails, except when expressing complete confidence in their judgments, but consistently overconfident for phishing emails. The second experiment compared performance on the laboratory task with individuals’ actual vulnerability, and found that participants with better resolution were less likely to have malicious files on their home computers. That comparison raised general questions about the design of anti-phishing training and of providing feedback essential to self-regulated learning.

Research problem: Phishing is an email-based scam where a perpetrator camouflages emails to appear as a legitimate request for personal and sensitive information. Research question: How do individuals process a phishing email, and determine whether to respond to it? Specifically, this study examines how users' attention to “visual triggers” and “phishing deception indicators” influence their decision-making processes and consequently their decisions. Literature review: This paper draws upon the theory of deception and the literature on mediated cognition and learning, including the critical role of attention and elaboration in deception detection. From this literature, we developed a research model to suggest that overall cognitive effort expended in email processing decreases with attention to visual triggers and phishing deception indicators. The likelihood to respond to phishing emails increases with attention to visceral cues, but decreases with attention to phishing deception indicators and cognitive effort. Knowledge of email-based scams increases attention to phishing deception indicators, and directly decreases response likelihood. It also moderates the impact of attention to visceral triggers and that of phishing deception indicators on likelihood to respond. Methodology: Using a real phishing email as a stimulus, a survey of 321 members of a public university community in the Northeast US, who were intended victims of a spear phishing attack that took place, was conducted. The survey used validated measures developed in prior literature for the most part and tested results using the partial least-squares regression. Results and discussion: Our research model and hypotheses were supported by the data except that we did not find that cognitive effort significantly affects response likelihood. The implication of the study is that attention to visceral triggers, attention to phishing deception indicators, and phishing knowledge play critical roles in phishing detection. The limitations of the study were that the data were drawn from students, and the study explored one phishing attack, relied on some single-item measures, cognitive effort measure, and a one-round survey. Future research would examine the impact of a varying degree of urgency and a varying level of phishing deception indicators, and actual victims of phishing attacks.

Natural language is most common way to communicate with each other but sometime we can't understand other languages to understand different languages machine translation is needed. Machine translation is the best application which helps to understand any other language in less cost and less time. In this some problems are faced by researchers: words which pronounce same but having different meaning, some words spelled different but having same meaning, in some cases combination of words may change the meaning. To resolve such kind of problems Word Sense Disambiguation is needed. Word Sense Disambiguation is used to understand the correct meaning of the word with respect to context in which that is used; Word Sense Disambiguation is the part of natural language processing. Word Net plays an important role in Word Sense Disambiguation. In this paper, we will discuss about the basic concept of Natural language processing, Machine Translation and Word sense disambiguation.

Minangkabau language (ML) is one of the daily communication tools used by the people of West Sumatra, Indonesia. ML is a challenge in communicating. The ML language translation process is necessary to facilitate communication. This study aims to build a translation system for ML into Indonesian by developing the concept of natural language processing (NLP). NLP development adopts the performance of morphology-based Minangkabau language stemming algorithm (MLSA) which can separate basic words with affixes and endings. The research dataset adopts 600 basic ML words sourced from the big Minangkabau dictionary. The results of this study provide analytic output that can translate ML into Indonesian well. These results are presented based on the testing process on basic word input with an accuracy rate of 97.16% and based on text documents of 91.65%. Thus, the MLSA performance process presents the accuracy of the translation process. Based on these results, this research contributes to developing a stemming algorithm model in carrying out the process of removing prefixes, inserts, and suffixes in the Minangkabau language. Overall, this research can be useful as a tool for translating the ML into Indonesian.

According to Thomson-Reuters the top cyber threat today is phishing in which people are tricked either to click a malicious link or give out personal information. It’s a fact that 96% of these phishing attacks comes from emails, which amount to more than 3.4 billion daily, as reported by Cisco. Austrian aerospace company FACC, Belgian bank Crelan, Acorn financial services and many other companies were recently fell victims of phishing emails losing millions of dollars. Even if experts provide lists of signs that users should seek in an email in order to understand if it is legitimate or scam, the attackers have elevated the quality of the email messages making them believable and very hard to discern them. In order to respond to this elevated threat, unconventional user training is required, focusing on recognizing a phishing email. Knowing how an attacker thinks and prepares the attack vector against a target, we claim that it will make users more suspicious when they receive one. In this regard, an innovative education intervention (consisted of two phases) was designed and developed. In the first phase, 98 participants were asked to visit an artificial social media profile and prepare a phishing email in order to persuade the victim to click a link. Then, the participants were presented with an innovative guided workflow to prepare a spear phishing email which was based on social media intelligence. In the second phase, they were asked to prepare one more email for the same person applying this time the guided workflow. Comparing the two different emails created, we found that the guided workflow led to the creation of more authentic emails which could potentially trick the victim easier. Based on the theory of active learning, we believe that by teaching users how attackers exploit their personal information in order to develop their attack vectors, it will increase their awareness not only for the typical phishing emails but also for more sophisticated spear phishing attacks.

Phishing is a type of social engineering where a potential victim is sent a message that impersonates a legitimate source or organization. Phishing attacks typically lure the targets into revealing confidential information such as password, credit card details, bank account numbers, or any other sensitive information. Human behavior and technology are two equally important aspects of phishing attacks, while current anti-phishing research have focused on the technology front, very few real life studies have been performed with a focus on the human aspects of phishing attacks. In this paper, we present the results of two large scale real life phishing attacks conducted on more than 10,000 community members of a university that includes students, alumni, faculty and staff. Our study is the first large scale phishing experiment on human subjects. Previous work suggests that users' demographics are useful indicators in identifying the most vulnerable users to phishing attacks. Our results illustrate that user demographics alone cannot predict user's susceptibility to phishing attacks. We also found that warning users about phishing risks alone is not sufficient to prevent more users from responding to the phishing attack. Even though subjects were warned not to respond to phishing emails, many disregarded the warning. We explain our findings through analysis of the empirical results of the two real life phishing attacks conducted.

A dual framework for implicit and explicit emotion recognition: An ensemble of language models and computational linguistics

Artificial intelligence (AI) is one of the key technologies of the Fourth Industrial Revolution (or Industry 4.0), which can be used for the protection of Internet-connected systems from cyber threats, attacks, damage, or unauthorized access. To intelligently solve today’s various cybersecurity issues, popular AI techniques involving machine learning and deep learning methods, the concept of natural language processing, knowledge representation and reasoning, as well as the concept of knowledge or rule-based expert systems modeling can be used. Based on these AI methods, in this paper, we present a comprehensive view on “AI-driven Cybersecurity” that can play an important role for intelligent cybersecurity services and management. The security intelligence modeling based on such AI methods can make the cybersecurity computing process automated and intelligent than the conventional security systems. We also highlight several research directions within the scope of our study, which can help researchers do future research in the area. Overall, this paper’s ultimate objective is to serve as a reference point and guidelines for cybersecurity researchers as well as industry professionals in the area, especially from an intelligent computing or AI-based technical point of view.

Text mining is a special case of data mining which explore unstructured or semi-structured text documents, to establish valuable patterns and rules that indicate trends and significant features about specific topics. Text mining has been in pattern recognition, predictive studies, sentiment analysis and statistical theories in many areas of research, medicine, financial analysis, social life analysis, and business intelligence. Text mining uses concept of natural language processing and machine learning. Machine learning algorithms have been used and reported to give great results, but their performance of machine learning algorithms is affected by factors such as dataset domain, number of classes, length of the corpus, and feature selection techniques used. Redundant attribute affects the performance of the classification algorithm, but this can be reduced by using different feature selection techniques and dimensionality reduction techniques. Feature selection is a data preprocessing step that chooses a subset of input variable while eliminating features with little or no predictive information. Feature selection techniques are Information gain, Term Frequency, Term Frequency-Inverse document frequency, Mutual Information, and Chi-Square, which can use a filters, wrappers, or embedded approaches. To get the most value from machine learning, pairing the best algorithms with the right tools and processes is necessary. Little research has been done on the effect of feature selection techniques on classification accuracy for pairing of these algorithms with the best feature selection techniques for optimal results. In this research, a text classification experiment was conducted using incident management dataset, where incidents were classified into their resolver groups. Support vector machine (SVM), K-Nearest Neighbors (KNN), Naïve Bayes (NB) and Decision tree (DT) machine learning algorithms were examined. Filtering approach was used on the feature selection techniques, with different ranking indices applied for optimal feature set and classification accuracy results analyzed. The classification accuracy results obtained using TF were, 88% for SVM, 70% for NB, 79% for Decision tree, and KNN had 55%, while Boolean registered 90%, 83%, 82% and 75%, for SVM, NB, DT, and KNN respectively. TF-IDF, had 91%, 83%, 76%, and 56% for SVM, NB, DT, and KNN respectively. The results showed that algorithm performance is affected by feature selection technique applied. SVM performed best, followed by DT, KNN and finally NB. In conclusion, presence of noisy data leads to poor learning performance and increases the computational time. The classifiers performed differently depending on the feature selection technique applied. For optimal results, the classifier that performed best together with the feature selection technique with the best feature subset should be applied for all types of data for accurate classification performance. Keywords: Text Classification, Supervised Machine Learning, Feature Selection DOI : 10.7176/JIEA/9-3-06 Publication date :May 31 st 2019

The concept of Natural Language Processing is immensely vast with a wide range of fields in which ideas can be explored and innovations can be developed. An algorithm based on deep learning is used to detect sarcasm in text in this paper. It is usually only possible to detect sarcasm through speech and very rarely through text. 1.3 million comments from Reddit were analyzed, of which half were sarcastic and half were not, and then various deep learning models were applied, such as standard neural networks, CNNs, and LSTM RNNs. The best performing model was LSTM-RNNs, followed by CNNs, and standard neural networks came last. With textual data, it is much harder to understand whether the other person is being sarcastic or not, it can only be understood by listening to their tone of voice or looking at their behaviour. The purpose of this paper is to demonstrate how to detect sarcasm in textual data using deep learning models.