Profiler: Distributed Model to Detect Phishing

Abstract

Many Machine Learning (ML) based phishing detection algorithms are not adept to recognise "concept drift"; attackers introduce small changes in the statistical characteristics of their phishing attempts to successfully bypass detection. This leads to the classification problem of frequent false positives and false negatives, and a reliance on manual reporting of phishing by users. Profiler is a distributed phishing risk assessment tool that combines three email profiling dimensions: (1) threat level, (2) cognitive manipulation, and (3) email content type to detect email phishing. Unlike pure ML-based approaches, Profiler does not require large data sets to be effective and evaluations on real-world data sets show that it can be useful in conjunction with ML algorithms to mitigate the impact of concept drift.