基于文本特征分析的钓鱼邮件检测

Detecting Phishing Email Based on Text Features Analysis

提出了一种基于邮件文本特征的钓鱼邮件检测方法。首先利用邮件解析器将邮件中非文本部分内容剔除,然后提取邮件剩余部分中存在的网站链接及其他内容,并在此基础上提取10种特征。针对这些特征,利用机器学习方法对其进行训练和预测,将邮件分类为普通邮件和钓鱼邮件。我们改进了以往一些针对网站链接分析的检测方法,并结合钓鱼邮件发展的新趋势,提出了6种新的特征。实验证明,本方法结合了新的钓鱼邮件特征,有效地提高了钓鱼邮件检测的召回率以及精准率,同时误判率有所降低。并且,本方法稍加改进以后就能用于钓鱼网站的检测。

A kind of phishing email detection based on text analysis is proposed.First,we deleted the non-text part of emails by email parsers.For the remaining part of the emails,we got the links and other contents,and extract ten features.According to the analysis of these features,the emails will be classified into ham and phishing by using machine learning method to train and forecast the emails.We improved the existed phishing detection which is based on the analysis of websites＇ links.By combining with the new trend of phishing email＇s development,we propose a method to extract some new features.The experiments shows that the proposed method demnonstrates a good performance in trems of recalling rate,false positive rate,and detection of phishing websites.