Phishing

AI-Enhanced Email Security: A Novel Pipeline for Phishing Campaign Detection and Profiling

In this study, we explore the integration of artificial intelligence (AI) into phishing (scam) mitigation, not as a replacement for human expertise but as a complement to it. We …

SoK: Grouping Spam and Phishing Email Threats for Smarter Security

Clustering phishing and spam attackes into groups often called campaigns has been an ongoing research direction, but the work on it uses a supprisingly wide range of definitions of …

Judging Phishing Under Uncertainty: How Do Users Handle Inaccurate Automated Advice?

Users need accurate and relevant guidance about phishing to take the right action on specific cases. This study investigates the effectiveness of guidance based on features …

PhishCoder: Efficient Extraction of Contextual Information from Phishing Emails

A novel framework designed to designed to extract contextual information from phishing emails. Our focus is on human-centric features, which are often overlooked in traditional …

Phishing Codebook: A Structured Framework for the Characterization of Phishing Emails

There is a significant knowledge gap about the qualitative traits embedded in phishing emails, which could be useful in a range of phishing mitigation tasks. In this paper, we …

Techreports with Security and Privacy Statistics

List of different sources of statistics that I use for research papers and presentations regarding security, privacy, and phishing.

Kami Vaniea

• Jun 24, 2024 • 1 min read

Read more

Using Clustering Algorithms to Automatically Identify Phishing Campaigns

Attackers attempt to create successful phishing campaigns by sending out trustworthy-looking emails with a range of variations, such as adding the recipient name in the subject …

"I didn't click": What users say when reporting phishing

When people report phishing emails they sometimes say something along with the report, such as asking a question, highlighting an aspect of the phishing, or asking for guidance. In …

Context-based Clustering to Mitigate Phishing Attacks

PhishED: Automated contextual feedback for reporting phishing

Phishing

Meta project for all the phishing research I do. The work spans topics like end-user education, URL reading ability, reporting phishing, and how administrators manage phishing.

Kami Vaniea

• Apr 27, 2021 • 1 min read

Read more

PhishEd

Automatically providing users with contextual anti-phishing advice based on a potential phishing message they report. Users are normally given lists of standardized general advice. …

What is this URL's Destination? Empirical Evaluation of Users' URL Reading

Common anti-phishing advice tells users to mouse over links, look at the URL, and compare to the expected destination, implicitly assuming that they are able to read the URL. To …

Analysis of publicly available anti-phishing webpages: contradicting information, lack of concrete advice and very narrow attack vector

Organizations often provide anti-phishing guidance to their customers and the Internet community at large. We analyzed 94 anti-phishing webpages from eight different countries and …

Automatic phishing detection versus user training, Is there a middle ground using XAI?