On-Device Smishing Classifier Resistant to Text Evasion Attack
Smishing (SMS phishing) is a cybercrime in which criminals send fraudulent messages, including malicious links, to steal the victims’ private data or cause financial losses. The damage caused by smishing has become more severe, particularly with the proliferation of mobile devices. In smi...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2024-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10380589/ |
| _version_ | 1797357101348028416 |
|---|---|
| author | Jae Woo Seo Jong Sung Lee Hyunwoo Kim Joonghwan Lee Seongwon Han Jungil Cho Choong-Hoon Lee |
| author_facet | Jae Woo Seo Jong Sung Lee Hyunwoo Kim Joonghwan Lee Seongwon Han Jungil Cho Choong-Hoon Lee |
| author_sort | Jae Woo Seo |
| collection | DOAJ |
| description | Smishing (SMS phishing) is a cybercrime in which criminals send fraudulent messages, including malicious links, to steal the victims’ private data or cause financial losses. The damage caused by smishing has become more severe, particularly with the proliferation of mobile devices. In smishing, a major difficulty faced by victims is discrimination between normal and smishing messages. To resolve this problem, we present an on-device smishing classifier based on a deep-learning model. In real-world scenarios, access to a substantial, authentic dataset is crucial. We trained and evaluated the classifier using real SMS datasets containing approximately 250,000 smishing messages and 950,000 normal messages obtained from victims in Korea. To ensure privacy, the classifier operates solely on mobile devices without externally transmitting any data. It utilizes a lightweight method that does not require significant computing power on mobile devices. We explored several models to determine a suitable model for mobile devices and optimized it using real datasets. Furthermore, our statistical analysis of actual smishing messages revealed that 98% of smishing messages are variants of previously sent messages. To address the prevalence of variant smishing messages, we propose a text evasion attack tool called EVA that is capable of generating pseudo-variant messages from a given message using an adversarial attack approach. We used this tool to evaluate and enhance the robustness of our classifier against various messages. Our classifier exhibited exceptional classification accuracy (0.99) while being lightweight (at 127 kB) and robust against variant smishing messages (attack success rate of 0.41). |
| first_indexed | 2024-03-08T14:39:56Z |
| format | Article |
| id | doaj.art-a3155723a32341d586c808cef3c71704 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-08T14:39:56Z |
| publishDate | 2024-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-a3155723a32341d586c808cef3c717042024-01-12T00:02:02ZengIEEEIEEE Access2169-35362024-01-01124762477910.1109/ACCESS.2024.334957710380589On-Device Smishing Classifier Resistant to Text Evasion AttackJae Woo Seo0https://orcid.org/0009-0000-8134-1947Jong Sung Lee1Hyunwoo Kim2Joonghwan Lee3https://orcid.org/0009-0004-7820-8415Seongwon Han4https://orcid.org/0009-0005-2198-1711Jungil Cho5Choong-Hoon Lee6https://orcid.org/0000-0001-5146-0259Samsung Research, Seoul, Republic of KoreaSamsung Research, Seoul, Republic of KoreaSamsung Research, Seoul, Republic of KoreaSamsung Research, Seoul, Republic of KoreaSamsung Research, Seoul, Republic of KoreaSamsung Research, Seoul, Republic of KoreaSamsung Research, Seoul, Republic of KoreaSmishing (SMS phishing) is a cybercrime in which criminals send fraudulent messages, including malicious links, to steal the victims’ private data or cause financial losses. The damage caused by smishing has become more severe, particularly with the proliferation of mobile devices. In smishing, a major difficulty faced by victims is discrimination between normal and smishing messages. To resolve this problem, we present an on-device smishing classifier based on a deep-learning model. In real-world scenarios, access to a substantial, authentic dataset is crucial. We trained and evaluated the classifier using real SMS datasets containing approximately 250,000 smishing messages and 950,000 normal messages obtained from victims in Korea. To ensure privacy, the classifier operates solely on mobile devices without externally transmitting any data. It utilizes a lightweight method that does not require significant computing power on mobile devices. We explored several models to determine a suitable model for mobile devices and optimized it using real datasets. Furthermore, our statistical analysis of actual smishing messages revealed that 98% of smishing messages are variants of previously sent messages. To address the prevalence of variant smishing messages, we propose a text evasion attack tool called EVA that is capable of generating pseudo-variant messages from a given message using an adversarial attack approach. We used this tool to evaluate and enhance the robustness of our classifier against various messages. Our classifier exhibited exceptional classification accuracy (0.99) while being lightweight (at 127 kB) and robust against variant smishing messages (attack success rate of 0.41).https://ieeexplore.ieee.org/document/10380589/Phone scamssmishingclassificationadversarial attacksadversarial training |
| spellingShingle | Jae Woo Seo Jong Sung Lee Hyunwoo Kim Joonghwan Lee Seongwon Han Jungil Cho Choong-Hoon Lee On-Device Smishing Classifier Resistant to Text Evasion Attack IEEE Access Phone scams smishing classification adversarial attacks adversarial training |
| title | On-Device Smishing Classifier Resistant to Text Evasion Attack |
| title_full | On-Device Smishing Classifier Resistant to Text Evasion Attack |
| title_fullStr | On-Device Smishing Classifier Resistant to Text Evasion Attack |
| title_full_unstemmed | On-Device Smishing Classifier Resistant to Text Evasion Attack |
| title_short | On-Device Smishing Classifier Resistant to Text Evasion Attack |
| title_sort | on device smishing classifier resistant to text evasion attack |
| topic | Phone scams smishing classification adversarial attacks adversarial training |
| url | https://ieeexplore.ieee.org/document/10380589/ |
| work_keys_str_mv | AT jaewooseo ondevicesmishingclassifierresistanttotextevasionattack AT jongsunglee ondevicesmishingclassifierresistanttotextevasionattack AT hyunwookim ondevicesmishingclassifierresistanttotextevasionattack AT joonghwanlee ondevicesmishingclassifierresistanttotextevasionattack AT seongwonhan ondevicesmishingclassifierresistanttotextevasionattack AT jungilcho ondevicesmishingclassifierresistanttotextevasionattack AT choonghoonlee ondevicesmishingclassifierresistanttotextevasionattack |