Detection of Spear Phishing Attacks Using Social Engineering Indicators

A spear phishing attack is an advanced type of phishing attack. These attacks utilize deception through personalized messages that target both individuals and organizations. Although they are not technically considered phishing, they utilize social engineering techniques to trick users into performing jobs. This paper proposes a way to detect spear phishing attacks by applying rules based on the combination of technical indicators and user behavior. The system evaluates several metrics to include,content pattern matching, authentication of the sender, and risk rating the content. The experimental results provide evidence that the proposed lightweight phishing detection framework system will improve the phishing detection performance of 85 percent to 90 percent when using social engineering indicators and technical analysis to highlight patterns in behavior. In addition, the proposed model requires very little computing power and can be deployed and effectively used in real time in an enterprise environment with far less reliance on large training datasets compared to machine-learning-based methods. The system uses a periodically updated rule set designed to address evolving phishing attack techniques to the changes being made to the different forms of phishing attacks and will continually be updated to reflect the latest rule sets associated with these attacks.