Research Article

Focusing on the Weakest Link: A Similarity Analysis on Phishing Campaigns Based on the ATT&CK Matrix

Table 1

Literature review on phishing techniques pertaining to the web.

FocusStudyResearch design Major findings

WebMao et al. (2017)Collected 9,307 verified phishing websites from PhishTank as an experiment sample set. It consists of phishing pages targeting popular website (e.g., PayPal, eBay, Apple).Phishing-Alarm, phishing attack detection solution extracts CSS-based page features, evaluates the similarity between whitelisted web pages and suspicious web page, and focuses on visual features that are hard to be tampered. 
This study presents techniques to identify effective CSS features as well as efficient algorithms for page similarity analysis. Authors prototyped Phishing-Alarm as an extension to the Google Chrome browser and evaluated it using a wild phishing web pages.
Corona et al. (2017)Empirically evaluated it on more than 5,500 web pages from compromised websites in the wild.DeltaPhish detects compromised phishing web page by highlighting HTML code and visual difference with respect to legitimate pages hosted within a compromised website. Web pages collected in the wild from infected websites were evaluated and performed capability of detecting more than 99% of phishing web pages, while less than 1% of false detection of legitimate pages. 
Adebowale et al. (2018)Dataset consisted of 4,898 phishing websites, 1,945 suspicious sites, and 6,157 legitimate websites from 2 prior studies (Rami et al., 2015a, 2015b) and PhishTank.Presents an Adaptive Neuro-Fuzzy Inference System (ANFIS) using integrated features of the text, images, and frames. This study utilized three different conventional classification algorithms (SVM, K-NN, and ANFIS). ANFIS algorithm achieved accuracies of 98.3% on web-phishing detection. 
Abdelnabi et al. (2020)VisualPhishNet examined 155 trusted phishing websites, which consists of 9,363 pages. VisualPhishNet, a similarity-based detection model based on triplet convolutional neural networks (CNN), examined VisualPhish.