An Investigation of AI-Based Ensemble Methods for the Detection of Phishing Attacks
Received: 20 March 2024 | Revised: 8 April 2024 | Accepted: 11 April 2024 | Online: 19 April 2024
Corresponding author: Yazan A. Alsariera
Abstract
Phishing attacks remain a significant cybersecurity threat in the digital landscape, leading to the development of defense mechanisms. This paper presents a thorough examination of Artificial Intelligence (AI)-based ensemble methods for detecting phishing attacks, including websites, emails, and SMS. Through the screening of research articles published between 2019 and 2023, 37 relevant studies were identified and analyzed. Key findings highlight the prevalence of ensemble methods such as AdaBoost, Bagging, and Gradient Boosting in phishing attack detection models. Adaboost emerged as the most used method for website phishing detection, while Stacking and Adaboost were prominent choices for email phishing detection. The majority-voting ensemble method was frequently employed in SMS phishing detection models. The performance evaluation of these ensemble methods involves metrics, such as accuracy, ROC-AUC, and F-score, underscoring their effectiveness in mitigating phishing threats. This study also underscores the availability of credible open-access datasets for the progressive development and benchmarking of phishing attack detection models. The findings of this study suggest the development of new and optimized ensemble methods for phishing attack detection.
Keywords:
AdaBoost, artificial intelligence, bagging, gradient boosting, phishing attack detectionDownloads
References
S. Madakam, R. Ramaswamy, and S. Tripathi, "Internet of Things (IoT): A Literature Review," Journal of Computer and Communications, vol. 3, no. 5, pp. 164–173, May 2015.
I. Mergel, N. Edelmann, and N. Haug, "Defining digital transformation: Results from expert interviews," Government Information Quarterly, vol. 36, no. 4, Oct. 2019, Art. no. 101385.
P. Seuwou and V. F. Adegoke, "The Changing Global Landscape With Emerging Technologies and Their Implications for Smart Societies," in Handbook of Research on 5G Networks and Advancements in Computing, Electronics, and Electrical Engineering, IGI Global, 2021, pp. 402–423.
S. Hussain, W. Guangju, R. M. S. Jafar, Z. Ilyas, G. Mustafa, and Y. Jianzhou, "Consumers’ online information adoption behavior: Motives and antecedents of electronic word of mouth communications," Computers in Human Behavior, vol. 80, pp. 22–32, Mar. 2018.
Y. K. Dwivedi et al., "Impact of COVID-19 pandemic on information management research and practice: Transforming education, work and life," International Journal of Information Management, vol. 55, Dec. 2020, Art. no. 102211.
R. Sujeetha, H. Das, T. Dhelawat, and M. Tanveer, "Cyber-Space and Its Menaces," in 2019 IEEE International Conference on System, Computation, Automation and Networking (ICSCAN), Pondicherry, India, Mar. 2019.
A. Basit, M. Zafar, X. Liu, A. R. Javed, Z. Jalil, and K. Kifayat, "A comprehensive survey of AI-enabled phishing attacks detection techniques," Telecommunication Systems, vol. 76, no. 1, pp. 139–154, Jan. 2021.
A. Chakraborty, A. Biswas, and A. K. Khan, "Artificial Intelligence for Cybersecurity: Threats, Attacks and Mitigation," in Artificial Intelligence for Societal Issues, A. Biswas, V. B. Semwal, and D. Singh, Eds. Cham, Switzerland: Springer International Publishing, 2023, pp. 3–25.
S. Garera, N. Provos, M. Chew, and A. D. Rubin, "A framework for detection and measurement of phishing attacks," in Proceedings of the 2007 ACM workshop on Recurring malcode, Alexandria, VA, USA, Aug. 2007, pp. 1–8.
S. Nasiri, M. T. Sharabian, and M. Aajami, "Using Combined One-Time Password for Prevention of Phishing Attacks," Engineering, Technology & Applied Science Research, vol. 7, no. 6, pp. 2328–2333, Dec. 2017.
A. Darem, "Anti-Phishing Awareness Delivery Methods," Engineering, Technology & Applied Science Research, vol. 11, no. 6, pp. 7944–7949, Dec. 2021.
D. Aljeaid, A. Alzhrani, M. Alrougi, and O. Almalki, "Assessment of End-User Susceptibility to Cybersecurity Threats in Saudi Arabia by Simulating Phishing Attacks," Information, vol. 11, no. 12, Dec. 2020, Art. no. 547.
A. Sadiq et al., "A review of phishing attacks and countermeasures for internet of things-based smart business applications in industry 4.0," Human Behavior and Emerging Technologies, vol. 3, no. 5, pp. 854–864, 2021.
K. Joshi et al., "Machine-Learning Techniques for Predicting Phishing Attacks in Blockchain Networks: A Comparative Study," Algorithms, vol. 16, no. 8, Aug. 2023, Art. no. 366.
M. Z. Gashti, "Detection of Spam Email by Combining Harmony Search Algorithm and Decision Tree," Engineering, Technology & Applied Science Research, vol. 7, no. 3, pp. 1713–1718, Jun. 2017.
R. Yang, K. Zheng, B. Wu, C. Wu, and X. Wang, "Phishing Website Detection Based on Deep Convolutional Neural Network and Random Forest Ensemble Learning," Sensors, vol. 21, no. 24, Jan. 2021, Art. no. 8281.
Y. A. Alsariera, A. V. Elijah, and A. O. Balogun, "Phishing Website Detection: Forest by Penalizing Attributes Algorithm and Its Enhanced Variations," Arabian Journal for Science and Engineering, vol. 45, no. 12, pp. 10459–10470, Dec. 2020.
C. Romero and S. Ventura, "Educational Data Mining: A Review of the State of the Art," IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews), vol. 40, no. 6, pp. 601–618, Aug. 2010.
Y. Baashar et al., "Customer relationship management systems (CRMS) in the healthcare environment: A systematic literature review," Computer Standards & Interfaces, vol. 71, Aug. 2020, Art. no. 103442.
Y. A. Alsariera, Y. Baashar, G. Alkawsi, A. Mustafa, A. A. Alkahtani, and N. Ali, "Assessment and Evaluation of Different Machine Learning Algorithms for Predicting Student Performance," Computational intelligence and neuroscience, vol. 2022, Jan. 2022, Art. no. 4151487.
Y. Baashar et al., "Toward Predicting Student’s Academic Performance Using Artificial Neural Networks (ANNs)," Applied Sciences, vol. 12, no. 3, Jan. 2022, Art. no. 1289.
A. Basit, M. Zafar, A. R. Javed, and Z. Jalil, "A Novel Ensemble Machine Learning Method to Detect Phishing Attack," in 2020 IEEE 23rd International Multitopic Conference (INMIC), Bahawalpur, Pakistan, Nov. 2020.
V. E. Adeyemo, A. O. Balogun, H. A. Mojeed, N. O. Akande, and K. S. Adewole, "Ensemble-Based Logistic Model Trees for Website Phishing Detection," in Advances in Cyber Security, Penang, Malaysia, 2021, pp. 627–641.
A. Awasthi and N. Goel, "Phishing website prediction using base and ensemble classifier techniques with cross-validation," Cybersecurity, vol. 5, no. 1, Nov. 2022, Art. no. 22.
Y. A. Alsariera, A. O. Balogun, V. E. Adeyemo, O. H. Tarawneh, and H. A. Mojeed, "Intelligent tree-based ensemble approaches for phishing website detection," Journal of Engineering Science and Technology, vol. 17, no. 1, pp. 563–582, 2022.
H. Agrawal and R. R. Singh, "An Ensemble Approach for Detecting Phishing Attacks," International Journal of Computer Sciences and Engineering, vol. 9, no. 7, pp. 53–59, Jul. 2021.
J. Gu and H. Xu, "An Ensemble Method for Phishing Websites Detection Based on XGBoost," in 2022 14th International Conference on Computer Research and Development (ICCRD), Shenzhen, China, Jan. 2022, pp. 214–219.
P. Ponnusamy and P. Dhandayudam, "An Optimized Bagging Learning with Ensemble Feature Selection Method for URL Phishing Detection," Journal of Electrical Engineering & Technology, vol. 19, no. 3, pp. 1881–1889, Mar. 2024.
M. Al-Sarem et al., "An Optimized Stacking Ensemble Model for Phishing Websites Detection," Electronics, vol. 10, no. 11, Jan. 2021, Art. no. 1285.
S. Menaka, J. Harshika, S. Philip, R. John, N. Bharathiraja, and S. Murugesan, "Analysing the Accuracy of Detecting Phishing Websites using Ensemble Methods in Machine Learning," in 2023 Third International Conference on Artificial Intelligence and Smart Energy (ICAIS), Coimbatore, India, Feb. 2023, pp. 1251–1256.
A. Das, F. I. Alam, S. Sharmin, and R. Uddin, "Boosting Guided Probabilistic Ensemble-based Approach For Phishing Website Detection," in 2022 International Conference on Innovations in Science, Engineering and Technology (ICISET), Chittagong, Bangladesh, Feb. 2022, pp. 402–407.
Y. Chandra and A. Jana, "Improvement in Phishing Websites Detection Using Meta Classifiers," in 2019 6th International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India, Mar. 2019, pp. 637–641.
A. Maini, N. Kakwani, R. B, S. M K, and B. R, "Improving the Performance of Semantic-Based Phishing Detection System Through Ensemble Learning Method," in 2021 IEEE Mysore Sub Section International Conference (MysuruCon), Hassan, India, Oct. 2021, pp. 463–469.
A. Taha, "Intelligent Ensemble Learning Approach for Phishing Website Detection Based on Weighted Soft Voting," Mathematics, vol. 9, no. 21, Jan. 2021, Art. no. 2799.
A. F. Nugraha and L. Rahman, "Meta-Algorithms for Improving Classification Performance in the Web-phishing Detection Process," in 2019 4th International Conference on Information Technology, Information Systems and Electrical Engineering (ICITISEE), Yogyakarta, Indonesia, Nov. 2019, pp. 271–275.
L. R. Kalabarige, R. S. Rao, A. Abraham, and L. A. Gabralla, "Multilayer Stacked Ensemble Learning Model to Detect Phishing Websites," IEEE Access, vol. 10, pp. 79543–79552, 2022.
D. M. Linh, H. D. Hung, H. M. Chau, Q. S. Vu, and T.-N. Tran, "Real-time phishing detection using deep learning methods by extensions," International Journal of Electrical and Computer Engineering (IJECE), vol. 14, no. 3, pp. 3021–3035, Jun. 2024.
A. Soni and J. Tiwari, "Phishing Website Detection Using Ensemble Learning," International Journal of Emerging Trends in Engineering Research, vol. 11, no. 1, pp. 17–20, Jan. 2023.
Z. Ghaleb Al-Mekhlafi et al., "Phishing websites detection by using optimized stacking ensemble model," Computer Systems Science and Engineering, vol. 41, no. 1, pp. 109–125, 2022.
F. Hossain, L. Islam, and M. N. Uddin, "PhishRescue: A Stacked Ensemble Model to Identify Phishing Website Using Lexical Features," in 2022 5th International Conference of Computer and Informatics Engineering (IC2IE), Jakarta, Indonesia, Sep. 2022, pp. 342–347.
M. K. Pandey, M. K. Singh, S. Pal, and B. B. Tiwari, "Prediction of phishing websites using machine learning," Spatial Information Research, vol. 31, no. 2, pp. 157–166, Apr. 2023.
K. Adane, B. Beyene, and M. Abebe, "Single and Hybrid-Ensemble Learning-Based Phishing Website Detection: Examining Impacts of Varied Nature Datasets and Informative Feature Selection Technique," Digital Threats: Research and Practice, vol. 4, no. 3, Jul. 2023, Art. no. 46.
D. Kaibassova, M. Nurtay, A. Tau, and M. Kissina, "Solving the Problem of Detecting Phishing Websites Using Ensemble Learning Models," Scientific Journal of Astana IT University, vol. 12, no. 12, pp. 55–64, Dec. 2022.
Y. Wei and Y. Sekiya, "Sufficiency of Ensemble Machine Learning Methods for Phishing Websites Detection," IEEE Access, vol. 10, pp. 124103–124113, 2022.
Z. G. Al-Mekhlafi and B. A. Mohammed, "Using Genetic Algorithms to Optimized Stacking Ensemble Model for Phishing Websites Detection," in Advances in Cyber Security, Penang, Malaysia, 2021, pp. 447–456.
M. Khatun, M. A. I. Mozumder, Md. N. H. Polash, Md. R. Hasan, K. Ahammad, and Md. S. Shaiham, "An Approach to Detect Phishing Websites with Features Selection Method and Ensemble Learning," International Journal of Advanced Computer Science and Applications, vol. 13, no. 8, pp. 768–775, 2022.
A. K. Shrivas, A. K. Dewangan, S. M. Ghosh, and D. Singh, "Development of Proposed Ensemble Model for Spam e-mail Classification," Information Technology and Control, vol. 50, no. 3, Sep. 2021.
S. Suryawanshi, A. Goswami, and P. Patil, "Email Spam Detection : An Empirical Comparative Study of Different ML and Ensemble Classifiers," in 2019 IEEE 9th International Conference on Advanced Computing (IACC), Tiruchirappalli, India, Sep. 2019, pp. 69–74.
Q. Qi, Z. Wang, Y. Xu, Y. Fang, and C. Wang, "Enhancing Phishing Email Detection through Ensemble Learning and Undersampling," Applied Sciences, vol. 13, no. 15, Jan. 2023, Art. no. 8756.
P. Bountakas and C. Xenakis, "HELPHED: Hybrid Ensemble Learning PHishing Email Detection," Journal of Network and Computer Applications, vol. 210, Jan. 2023, Art. no. 103545.
M. Adnan, M. O. Imam, M. F. Javed, and I. Murtza, "Improving spam email classification accuracy using ensemble techniques: a stacking approach," International Journal of Information Security, vol. 23, no. 1, pp. 505–517, Feb. 2024.
D. M. Ablel-Rheem, A. O. Ibrahim, S. Kasim, A. A. Almazroi, and M. A. Ismail, "Hybrid feature selection and ensemble learning method for spam email classification," International Journal of Advanced Trends in Computer Science and Engineering, vol. 9, no. 1.4 Special Issue, pp. 217–223, 2020.
A. Mahabub, M. I. Mahmud, and M. F. Hossain, "A Robust System for Message Filtering Using an Ensemble Machine Learning Supervised Approach," ICIC Express Letters, vol. 10, no. 9, pp. 805–811, 2019.
A. Ghourabi and M. Alohaly, "Enhancing Spam Message Classification and Detection Using Transformer-Based Embedding and Ensemble Learning," Sensors, vol. 23, no. 8, Jan. 2023, Art. no. 3861.
J. Fattahi and M. Mejri, "SpaML: a Bimodal Ensemble Learning Spam Detector based on NLP Techniques," in 2021 IEEE 5th International Conference on Cryptography, Security and Privacy (CSP), Zhuhai, China, Jan. 2021, pp. 107–112.
N. Sharma, "A Methodological Study of SMS Spam Classification Using Machine Learning Algorithms," in 2022 2nd International Conference on Intelligent Technologies (CONIT), Hubli, India, Jun. 2022.
A. Al Maruf, A. Al Numan, Md. M. Haque, T. T. Jidney, and Z. Aung, "Ensemble Approach to Classify Spam SMS from Bengali Text," in Advances in Computing and Data Sciences, Kolkata, India, 2023, pp. 440–453.
S. Hosseinpour and H. Shakibian, "An Ensemble Learning Approach for SMS Spam Detection," in 2023 9th International Conference on Web Research (ICWR), Tehran, Iran, May 2023, pp. 125–128.
R. Mohammad and L. McCluskey, "Phishing Websites.", UC Irvine Machine Learning Repository, 2012.
N. Abdelhamid, "Website Phishing.", UC Irvine Machine Learning Repository, 2014.
C. L. Tan, "Phishing Dataset for Machine Learning: Feature Evaluation.", Mendeley Data, 2018.
G. Vrbančič, "Phishing Websites Dataset." Mendeley Data, 2020.
A. Hannousse and S. Yahiouche, "Web page phishing detection." Mendeley Data, 2021.
M. Hopkins, E. Reeber, G. Forman, and J. Suermondt, "Spambase." UC Irvine Machine Learning Repository, 1999, https://doi.org/10.24432/
C53G6X.
P. Bountakas, "HELPED - Email Spam Dataset." 2021.
W. W. Cohen, "Enron Email Dataset." 2015, [Online]. Available: https://www.cs.cmu.edu/~enron/.
"Apache SpamAssassin." https://spamassassin.apache.org/.
"SMS Spam Collection Dataset." [Online]. Available: https://www.kaggle.com/datasets/uciml/sms-spam-collection-dataset.
AbayomiAlli, "SMS Spam Dataset." 2023, [Online]. Available: https://github.com/AbayomiAlli/SMS-Spam-Dataset.
Y. A. Alsariera, V. E. Adeyemo, A. O. Balogun, and A. K. Alazzawi, "AI Meta-Learners and Extra-Trees Algorithm for the Detection of Phishing Websites," IEEE Access, vol. 8, pp. 142532–142542, 2020.
Y. A. Alsariera, "Detecting Generic Network Intrusion Attacks using Tree-based Machine Learning Methods," International Journal of Advanced Computer Science and Applications, vol. 12, no. 2, 2021.
Downloads
How to Cite
License
Copyright (c) 2024 Yazan A. Alsariera, Meshari H. Alanazi, Yahia Said, Firas Allan
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
