Phishing Detection, AI/ML and Fraud Research

QuestionHow can phishing webpages be identified reliably, including previously unseen attacks that evade simple lists?

MethodThe thesis applies AI/ML algorithms to real webpage datasets, using feature engineering across URLs, domains, page content, structure and visual characteristics.

FindingsThe analytical evaluation shows that combining well-prepared data with multiple webpage indicators gives machine-learning models more useful evidence than relying on a single signal.

Practical implicationAnti-phishing defenses should combine complementary indicators and validate AI/ML models on current, representative data.

QuestionHow can researchers build phishing datasets that are balanced, current and comparable across studies?

MethodThe study applies data preparation, feature engineering and comparative analytics to test dataset size, class ratios and up to 111 URL and external features across multiple AI/ML algorithms.

FindingsModel evaluation shows that more data helps only to a point. Feature breadth and the phishing-to-legitimate ratio also change balanced accuracy.

Practical implicationAI/ML teams should document data provenance, remove duplicates and validate dataset composition before comparing algorithms.

QuestionHow often do confirmed phishing URLs use recognizable URL and domain obfuscation techniques?

MethodThe study applies longitudinal data analytics to a 15-year phishing dataset, engineering indicators for IP-address hosts, URL shorteners, unusual ports and Punycode.

FindingsThe analysis finds that each reviewed technique appears in less than about 3% of phishing URLs. IP addresses, shorteners, ports and Punycode are the most common.

Practical implicationThese indicators can contribute to a wider detection feature set, but their low prevalence makes them unsuitable as stand-alone rules.

QuestionHow long do phishing webpages remain active, and which characteristics are associated with their lifespan?

MethodThe study applies longitudinal analytics to phishing webpages, comparing availability and takedown patterns across observed cases over time.

FindingsPhishing pages do not disappear at a uniform rate, leaving a meaningful interval in which users can still encounter active attacks.

Practical implicationDetection and takedown processes should account for time-to-removal and continue monitoring after initial discovery.

QuestionHow much phishing can a continuously updated domain blacklist detect, and how often are malicious domains reused?

MethodThe analysis merges and cleans ten years of PhishTank and PhishStats records from 2013 to 2022, then replays them chronologically against a growing blacklist.

FindingsThe longitudinal analytics show that about 22% of phishing domains recur, while year-by-year blacklist efficacy varies substantially.

Practical implicationBlacklists remain useful as one control, but coverage gaps require complementary behavioral, content and model-based detection.

QuestionWhich automated techniques are used to detect phishing, and what evidence does each approach rely on?

MethodThe paper reviews blacklist, heuristic, content-based and machine-learning approaches and compares their operating principles.

FindingsDetection approaches differ in speed, adaptability, data requirements and ability to identify attacks that have not been seen before.

Practical implicationLayered detection is more resilient than dependence on one technique, particularly as phishing tactics change.

QuestionHow can a bank use multiple communication channels to improve customer awareness of fraud and phishing?

MethodThe study examines awareness and education delivered through different banking communication channels and considers their complementary roles.

FindingsNo single channel reaches every customer in the same context, so coordinated messaging broadens exposure and reinforces learning.

Practical implicationBanks should plan awareness as a multi-channel program with consistent messages adapted to each point of contact.

QuestionCan AI/ML algorithms distinguish phishing pages from legitimate pages using measurable webpage characteristics?

MethodWe derived analytical features from collected webpage data and applied data-mining and AI/ML classification algorithms to identify phishing patterns.

FindingsThe model analysis showed that data-driven classification can expose combinations of indicators that are difficult to capture with isolated manual rules.

Practical implicationOperational AI/ML models need representative training data, careful feature engineering and continued validation as attacks evolve.