Comprehensive method for detecting phishing emails using correlation-based analysis and user participation

Phishing email has become a popular solution among attack- ers to steal all kinds of data from people and easily breach organizations' security system. Hackers use multiple tech- niques and tricks to raise the chances of success of their attacks, like using information found on social networking websites to tailor their emails to the target's interests, or targeting employees of an organization who probably can't spot a phishing email or malicious websites and avoid sending emails to IT people or employees from Security depart- ment. In this paper we focus on analyzing the coherence of information contained in the different parts of the email: Header, Body, and URLs. After analyzing multiple phish- ing emails we discovered that there is always incoherence between these different parts. We created a comprehensive method which uses a set of rules that correlates the infor- mation collected from analyzing the header, body and URLs of the email and can even include the user in the detection process. We take into account that there is no such thing called perfection, so even if an email is classified as legit-imate, our system will still send a warning to the user if the email is suspicious enough. This way even if a phishing email manages to escape our system, the user can still be protected. © 2017 ACM.