LSTM Based Phishing Detection for Big Email Data

Aim:

          Cybersecurity incidents have occurred frequently. Attackers have used phishing emails as a knock-on to successfully invade government systems. Therefore, we designed a phishing email detection  method based on Bidirectional LSTM neural network

Abstract:

          In  recent years, cybercriminals have successfully invaded many important information systems by using  phishing mail, causing huge losses. The detection of phishing mail from big email data has been paid public attention. However, the camouflage technology of phishing mail is becoming more and more complex, and the existing detection methods are unable to confront the increasingly complex deception methods and the growing number of emails. In this article, we proposed an Bidirectional LSTM-based phishing detection method for big email data. Then, the preprocessed data is used to train an Bidirectional LSTM model. Finally, based on the trained model, we classify phishing emails. By experiment, we evaluate the performance of the proposed method.

Synopsis:

        Phishing emails often cause economic damage to enterprises. Phishing emails lead to the leakage of private information, which causes damage to the industry or even the country. Unlike attacks that exploit specific technical vulnerabilities in software and protocols, phishing attacks are based on social engineering. By sending fraudulent emails, the attacker induces the recipient to take some dangerous actions (such as clicking on links, entering passwords, etc.) without knowing it. From the attacker’s point of view, phishing attack does not need too much technical cost, does not depend on any specific vulnerabilities, and is easier to avoid technical defense than malware attack.. We predict the phishing ails based on different features and using Bi-LSTM.

Proposed System:

          The proposed system consists of 4 steps we used a phishing email feature extraction algorithm to extract the characteristics of the email, and then use the extracted features to cluster the emails, to achieve accurate labeling of phishing emails. Finally, we train the model and compare the proposed method with the traditional phishing email detection method by the experiment. Our method performed better than the existing phishing email detection method, it improves accuracy, reduces the false negative rate and false positive rate.

Advantage:

       Advantages in dealing with time series and text sequence problems. However, it is difficult for RNNs to learn long-distance information. Bidirectional LSTM is a special form of  RNN  that overcomes the problems of the classic RNN model. Orthogonal initialize is also used to solve the gradient disappearance and gradient explosion  problem in the deep network that comes from the excessive length of the message body.