Phishing | Kami Vaniea

AI-Enhanced Email Security: A Novel Pipeline for Phishing Campaign Detection and Profiling

Fri, 26 Jun 2026 00:00:00 +0000

SoK: Grouping Spam and Phishing Email Threats for Smarter Security

Fri, 28 Mar 2025 00:00:00 +0000

Judging Phishing Under Uncertainty: How Do Users Handle Inaccurate Automated Advice?

Wed, 26 Mar 2025 00:00:00 +0000

PhishCoder: Efficient Extraction of Contextual Information from Phishing Emails

Fri, 13 Sep 2024 00:00:00 +0000

Phishing Codebook: A Structured Framework for the Characterization of Phishing Emails

Fri, 16 Aug 2024 00:00:00 +0000

Techreports with Security and Privacy Statistics

Mon, 24 Jun 2024 00:00:00 +0000

This page contains a list of techreports, white papers, and other sources of statistics about the current state of computer security and privacy. Companies and other large organizations often publish reports of statistics involving security and privacy that represent the state of security from their vantage point. These reports are generally respected and can be used in academic publications to describe the current state of security and privacy. However, be aware that the reports only provide a view from that one organization. It is generally a good idea to look at statistics from several of the reports below to get a wider view of what different organizations are seeing.

Many of the reports below are published yearly or sometimes every quarter so more recent versions may exist than what is listed here.

Sources

General Security Reports

(Previously known as Microsoft Security Intelligence Report)
NCSC: Cyber Security Breaches Survey ( , , )
CrowdStrike’s State of Application Security Report
Cloudflare’s Application Security Report

Privacy

: The current use, development and limits of Privacy Enhancing Technologies in data analysis by the Royal Society, March 2019

Transparency Reports

Transparency reports mostly for Facebook and Instagram. WhatsApp notably missing.

Phishing

- Proofpoint offers phishing training, and testing. Techreport is derived from data from their products as well as a survey they run across multiple countries

Government reports

- Includes measures of “Being Safe and Legal Online” and “Handling Information and Content”
– The Facts 2021
UK Cyber Security Breaches Survey ( , , )

Using Clustering Algorithms to Automatically Identify Phishing Campaigns

Tue, 01 Aug 2023 00:00:00 +0000

"I didn't click": What users say when reporting phishing

Wed, 01 Feb 2023 00:00:00 +0000

Context-based Clustering to Mitigate Phishing Attacks

Tue, 01 Nov 2022 00:00:00 +0000

PhishED: Automated contextual feedback for reporting phishing

Mon, 01 Aug 2022 00:00:00 +0000

PhishEd

Tue, 27 Apr 2021 00:00:00 +0000

Phishing is one of the most effective vectors for tricking users into providing sensitive information, such as account details, to attackers who then use the information to harm users, organizations, and society at large. Recent attacks, such as the Colonial Pipeline shutdown in the US can be attributed to phishing. In the UK, 86% of businesses reported receiving phishing attacks [1] and while 76% of UK users believe that they can recognize and avoid suspicious links in emails [2], our own research shows that only about 8% can accurately read a URL [3]. The staggering £53.7 million lost in the UK in 2020 to impersonation fraud also attests to the problem [4].

Employer-provided training tends to be delivered either up-front or given after the employee has fallen for a mock phishing attack. These approaches do work, but they are very employer-centric in that employers choose the time and content of the training. Delivering the same training to everyone also forces a compromise between comprehensively covering topics and containing detailed actionable guidance. For example, training commonly advises users to “look at the destination of links” but does not have the space to explain how to do so. Users in this situation have virtually no agency or control and lack the ability to shape their own learning to match their needs. Users also experience phishing as an infrequent unexpected event that is mixed in with other activities. Phishing by its nature is designed to appear urgent or threatening. A user receiving such a message may be worried or scared about what might happen if they were to ignore it. Currently their only options are to delete the potential phish (scary) or report it and ask for advice (slow).

In this project, we propose a novel phishing-advice tool, PhishEd, which accepts reports from users of potential phishing emails, uses AI to parse out contextual phishing features, and quickly responds back to the user with advice based on the content of the reported email. to explain the reasoning or frame the decision the user needs to make. For example, a reported phishing might contain “HMRC” but have links leading to Dropbox. The auto response would inform the user that the email is not from HMRC (DKIM) and the links lead to Dropbox which HMRC would never use. It would also provide examples from the email to evidence these claims. The objectives of this project are: (i) help users confidently make safety decisions, (ii) teach them skills about how to detect fraud, and (iii) make them want to report phishing in the future.

NCSC Cyber Security Breaches Survey 2020.
UK Consumer Digital Index 2019.
S.S. Albakry, K. Vaniea, M.K. Wolters; What is this URL’s Destination? Empirical Evaluation of Users’ URL Reading; In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. 2020.
UK Finance, Fraud – The Facts 2021.

Phishing

Tue, 27 Apr 2021 00:00:00 +0000

My lab has a range of publications and projects involving phishing. This project page provides an overview of the different types of work we conduct.

PhishEd aims to make reporting phishing a helpful and friendly experience where the user feels heard, gets helpful feedback, and can confidently determine if an urgent sounding email is fraudulent or real.

People

Sara Albakry
Kholoud Althobaiti
Adam Jenkins
Tarini Saka
Nadin Kokciyan
Kami Vaniea

What is this URL's Destination? Empirical Evaluation of Users' URL Reading

Sat, 25 Apr 2020 00:00:00 +0000

Analysis of publicly available anti-phishing webpages: contradicting information, lack of concrete advice and very narrow attack vector

Wed, 01 Jan 2020 00:00:00 +0000

Automatic phishing detection versus user training, Is there a middle ground using XAI?

Fri, 01 Jun 2018 00:00:00 +0000