A survey and classification of web phishing detection schemes

TLDR

Phishing is an Internet fraud that deceives users via email spoofing and fake websites to steal personal data, and despite ongoing research, no comprehensive solution exists. The study surveys and classifies key phishing‑website detection strategies, outlining their strengths and weaknesses. The authors review and categorize recent phishing‑website detection schemes, providing a detailed analysis of their subcategory approaches. The survey highlights advantages, drawbacks, and research gaps in phishing‑website detection, guiding academia and industry toward optimal anti‑phishing techniques. © 2016 John Wiley & Sons, Ltd.

Abstract

Abstract Phishing is a fraudulent technique that is used over the Internet to deceive users with the goal of extracting their personal information such as username, passwords, credit card, and bank account information. The key to phishing is deception. Phishing uses email spoofing as its initial medium for deceptive communication followed by spoofed websites to obtain the needed information from the victims. Phishing was discovered in 1996, and today, it is one of the most severe cybercrimes faced by the Internet users. Researchers are working on the prevention, detection, and education of phishing attacks, but to date, there is no complete and accurate solution for thwarting them. This paper studies, analyzes, and classifies the most significant and novel strategies proposed in the area of phished website detection, and outlines their advantages and drawbacks. Furthermore, a detailed analysis of the latest schemes proposed by researchers in various subcategories is provided. The paper identifies advantages, drawbacks, and research gaps in the area of phishing website detection that can be worked upon in future research and developments. The analysis given in this paper will help academia and industries to identify the best anti‐phishing technique. Copyright © 2016 John Wiley & Sons, Ltd.