What Phishing E-mails Reveal: An Exploratory Analysis of Phishing Attempts Using Text Analysis

Abstract

ABSTRACT Accountants and auditing firms are frequent phishing targets because of the proximity to organizational resources. Since phishing typically is done using emails, text analysis is used to explore differences between phishing e gmails and other emails. By analyzing and comparing a database of phishing messages to a database of the Enron emails, we find that the phishing data is statistically significantly different across a large number of univariate text variable categories. Further, we generate a model of phishing as “power,” based on independent variables of friend (who they pretend to be), achievement (of their goal), (to take your) money, and (typically done at) work. These variables are used as a basis to estimate power in both the phishing and non-phishing messages, where we find differences on the signs of the independent variables. Finally, using text analysis, we examine the ability of neural network models to differentiate between phishing emails and Enron emails.