{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,4,15]],"date-time":"2025-04-15T10:07:19Z","timestamp":1744711639683,"version":"3.37.3"},"reference-count":124,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2017]]},"DOI":"10.1109\/comst.2017.2752087","type":"journal-article","created":{"date-parts":[[2017,9,13]],"date-time":"2017-09-13T18:09:08Z","timestamp":1505326148000},"page":"2797-2819","source":"Crossref","is-referenced-by-count":75,"title":["Systematization of Knowledge (SoK): A Systematic Review of Software-Based Web Phishing Detection"],"prefix":"10.1109","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3880-5125","authenticated-orcid":false,"given":"Zuochao","family":"Dou","sequence":"first","affiliation":[]},{"given":"Issa","family":"Khalil","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1583-713X","authenticated-orcid":false,"given":"Abdallah","family":"Khreishah","sequence":"additional","affiliation":[]},{"given":"Ala","family":"Al-Fuqaha","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8972-8094","authenticated-orcid":false,"given":"Mohsen","family":"Guizani","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"ref39","article-title":"EMD based visual similarity for detection of phishing webpages","volume":"2005","author":"fu","year":"2005","journal-title":"Proc Int Workshop Web Doc Anal"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2006.50"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2017.2691550"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/4286903"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1124772.1124861"},{"key":"ref30","article-title":"Phinding phish: An evaluation of anti-phishing toolbars","author":"cranor","year":"2007","journal-title":"Proc NDSS"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2014.7004239"},{"key":"ref36","doi-asserted-by":"crossref","first-page":"1065","DOI":"10.1145\/1357054.1357219","article-title":"You’ve been warned: An empirical study of the effectiveness of Web browser phishing warnings","author":"egelman","year":"2008","journal-title":"Proc SIGCHI Conf Human Factors Comput Syst"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/1143120.1143131"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2017.2669908"},{"key":"ref28","article-title":"Client-side defense against Web-based identity theft","author":"chou","year":"2004","journal-title":"Proc NDSS"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/2584680"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504771"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2015.7346927"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/1866423.1866434"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2010-0371"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2013.106"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/1456424.1456434"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2016.05.005"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1754393.1754394"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2016.76"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2009.59"},{"journal-title":"Google Safe Browsing","year":"2016","key":"ref50"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/1290958.1290968"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.032213.00009"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897877"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/IACS.2016.7476087"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897925"},{"key":"ref55","first-page":"105","article-title":"TPM-based authentication mechanism for apache hadoop","author":"khalil","year":"2014","journal-title":"Proc Int Conf Secur Privacy Commun Syst"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2005.12.004"},{"key":"ref53","article-title":"Secos: Key management for scalable and energy efficient crypto on sensors","author":"khalil","year":"2003","journal-title":"Proc IEEE Dependable Syst Netw"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315254"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/1314389.1314391"},{"journal-title":"Anti-Phishing Working Group","year":"2016","key":"ref4"},{"journal-title":"Anti-Phishing Extension Netcraft","year":"2016","key":"ref3"},{"journal-title":"DMOZ—The Directory of the Web","year":"2016","key":"ref6"},{"journal-title":"Clean MX Malicious URL List","year":"2016","key":"ref5"},{"journal-title":"Millersmiles Spoof Email and Phishing Scams List","year":"2016","key":"ref8"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/2063176.2063197"},{"journal-title":"MALWARE","year":"2016","key":"ref7"},{"journal-title":"SURBL URL REPUTATION DATA","year":"2016","key":"ref9"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CICYBS.2009.4925087"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978330"},{"key":"ref48","article-title":"Measuring and detecting fast-flux service networks","author":"holz","year":"2008","journal-title":"Proc Symp Netw Distrib Syst Security"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1002\/sapm1941201224"},{"journal-title":"Geotrust TrustWatch Toolbar","year":"2016","key":"ref42"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2011.5721063"},{"journal-title":"Anti-Phishing Working Group","year":"2016","key":"ref44"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2017.2736886"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242659"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/1553374.1553462"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/1557019.1557153"},{"key":"ref71","doi-asserted-by":"crossref","first-page":"693","DOI":"10.1111\/j.1467-985X.2010.00646_6.x","article-title":"The elements of statistical learning: Data mining, inference, and prediction","volume":"173","author":"lu","year":"2010","journal-title":"J Royal Statistical Soc Statistics in Soc"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR.2010.1010"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/2212776.2223683"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/1460877.1460905"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2014.2377295"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2016.10"},{"key":"ref78","doi-asserted-by":"crossref","first-page":"422","DOI":"10.12753\/2066-026X-16-061","article-title":"Management of eLearning platforms security","volume":"1","author":"mihai","year":"2016","journal-title":"Proc Int Sci Conf eLearn Softw Educ"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2016.01.028"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/1299015.1299022"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CLOUD.2014.114"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/1754393.1754396"},{"journal-title":"Spoofguard","year":"2004","key":"ref63"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/90.731185"},{"article-title":"A study of Internet routing stability using link weight","year":"2008","author":"lad","key":"ref65"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2011.5934995"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1016\/j.jesp.2013.03.013"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2010.5484762"},{"journal-title":"Alexa Top 500 Sites","year":"2016","key":"ref2"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2008.335"},{"journal-title":"Phishing Trends & Intelligence Report Hacking the Human","year":"2016","key":"ref1"},{"journal-title":"Avalanche (Phishing Group)—Wikipedia the Free Encyclopedia","year":"2016","key":"ref109"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/347057.347426"},{"key":"ref108","article-title":"Large-scale automatic classification of phishing pages","volume":"10","author":"whittaker","year":"2010","journal-title":"Proc NDSS"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/WKDD.2010.108"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2011.103"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1097\/00004728-199511000-00026"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/ICDAR.2005.190"},{"article-title":"Gone phishing: Evaluating anti-phishing tools for windows","year":"2006","author":"robichaux","key":"ref92"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2008.4625681"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637232"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/TPC.2012.2208392"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2014.01.002"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1674"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.25"},{"journal-title":"Mcafee Siteadvisor—Wikipedia the Free Encyclopedia","year":"2016","key":"ref111"},{"journal-title":"Microsoft Smartscreen—Wikipedia the Free Encyclopedia","year":"2016","key":"ref112"},{"journal-title":"Bag-of-Words Model—Wikipedia the Free Encyclopedia","year":"2016","key":"ref110"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/1280680.1280692"},{"key":"ref99","first-page":"57","article-title":"Shades of grey: On the effectiveness of reputation-based ‘blacklists","author":"sinha","year":"2008","journal-title":"Proceedings of the 3rd International Conference on Malicious and Unwanted Software"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/AICCSA.2008.4493625"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1145\/1753326.1753383"},{"journal-title":"Global Phishing Survey Trends and Domain Name Use in 2H2009","year":"2010","author":"aaron","key":"ref10"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2008.ECP.386"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/1299015.1299021"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2010.04.044"},{"key":"ref14","article-title":"Phishing detection plug-in toolbar using intelligent fuzzy-classification mining techniques","author":"aburrous","year":"2013","journal-title":"Proc Int Conf Soft Comput Softw Eng"},{"key":"ref15","article-title":"Phishzoo: An automated Web phishing detection approach based on profiling and fuzzy matching","author":"afroz","year":"2009","journal-title":"Proc 5th IEEE Int Conf Semantic Comput (ICSC)"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1145\/2019599.2019606"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/eCrime.2012.6489521"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2015.14"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1007\/s10115-007-0114-2"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/AICCSA.2009.5069395"},{"journal-title":"PhishTank An anti-phishing site","year":"2016","key":"ref81"},{"key":"ref18","first-page":"1","article-title":"Spamscatter: Characterizing Internet scam hosting infrastructure","author":"anderson","year":"2007","journal-title":"Proc Usenix Security"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2006.13"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1145\/1526709.1526786"},{"journal-title":"APWG Phishing Trends Reports","year":"2016","key":"ref19"},{"journal-title":"Phishing Safety Is HTTPS Enough?","year":"0","author":"pajares","key":"ref83"},{"journal-title":"Yahoo! Directory—Wikipedia the Free Encyclopedia","year":"2016","key":"ref114"},{"journal-title":"Netcraft—Wikipedia the Free Encyclopedia","year":"2016","key":"ref113"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1145\/1124772.1124863"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-013-1490-z"},{"journal-title":"Zero-Day (Computing)—Wikipedia the Free Encyclopedia","year":"2016","key":"ref115"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/ASONAM.2010.56"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2012.6284100"},{"key":"ref121","first-page":"10","article-title":"Spark: Cluster computing with working sets","author":"zaharia","year":"2010","journal-title":"Proc HotCloud"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2011.2161999"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2015.70"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2007.11.015"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(12)70007-6"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2010.5462216"},{"key":"ref88","article-title":"Can DNS-based blacklists keep up with bots","author":"ramachandran","year":"2006","journal-title":"Proc of the Conf on Email and Anti-Spam"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/8115327\/08036198.pdf?arnumber=8036198","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,8,25]],"date-time":"2023-08-25T20:35:45Z","timestamp":1692995745000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/8036198\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"references-count":124,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/comst.2017.2752087","relation":{},"ISSN":["1553-877X"],"issn-type":[{"type":"electronic","value":"1553-877X"}],"subject":[],"published":{"date-parts":[[2017]]}}}