The paper introduces the field of cyber attacks, more precisely phishing attacks and the role of social engineering in the success of such attacks. The introduction is followed by a brief history overview and known phishing attacks. Then, a presentation of different types of phishing is shown (email phishing, phishing via call or SMS, phishing via social media, etc.), of which mass email phishing is the most widespread. Detection and prevention software for phishing attacks is presented next. The properties on the basis of which we distinguish harmful emails from harmless ones and their use are given. As the practical part largely includes machine learning to detect harmful emails, the work places more emphasis on machine learning as a tool for recognizing phishing attacks in emails. Detailed descriptions of four algorithms are given, namely the Naive Bayes, Decision Tree, Random Forest and Support Vector Method. The following is a practical example of the entire process of detecting phishing emails through the implementation of Naive Bayes and Decision Tree algorithms, which are designed to build predictive models based on a given database of emails. Eighty percent of the database is dedicated to teaching the model, whereas twenty percent to model testing. Both algorithms classify emails from the database very well. In the second part of the practical work, the entire construction of the Thunderbird email plug-in is shown. A clear system architecture is given, as well as a demonstration of the plug-in’s operation with harmful and harmless emails. The plug-in’s interface provides the user with a clear overview of phishing properties in emails through twelve traffic lights, whose colors indicate the potential phishing danger due to each property contained in the email. The work is concluded by testing of the developed plug-in and suggestions for possible upgrades and improvements.
|
