A Novel Approach to Detect Spam and Smishing SMS using Machine Learning Techniques

1.1. Contextualization

Smishing is a cyber-security attack in which the mobile user is deceived into installing malicious software into their mobile phone. Smishing word is constructed by the combination of two words i.e. SMS + Phishing = Smishing. In other words, smishing message is a harmful spam message which aims at stealing mobile users’ sensitive data (Goel & Jain, 2018). These messages may contain a link. On following the link, the user is asked to enter their details for verification purpose (Choudhary & Jain, 2017). Attackers also lure victims by sending messages that look like they originate from an authentic bank, stating that their account has been locked and to unlock the account, the victim is asked to follow the link in the message. The purpose of spam messages is generally to promote some product or to disturb the user with useless messages. On the other hand, phishing message always have some criminal intent. The effect of smishing attack is financial loss and identity theft.

1.2. Importance/Relevance of the Theme

Smishing attacks are increasing day by day as attackers find SMS, a cheaper and more convenient way to communicate with victims (“Why do phishing attacks work better on mobile phones,” 2011). Smartphone users are considered to be three times more likely to fall victims of phishing attacks than desktop users (MOBILE THREAT REPORT, 2012). In 2014, cloud mark report (Hacked Hotel Phones Fueled Bank Phishing Scams, 2015) identified a phishing SMS, which attempted to steal user’s secret information like credit card number, bank account details, etc. A smishing message was sent to thousands of people with different bank affiliations (SMiShing & Vishing News, 2017).

1.3. Research Question

There are various security measures available to control SMS Spam problem, but these are not so mature. Many Android apps (Spam Blocker App; Mr. Number - Caller ID & Spam Protection) are also available on play store. However, their detection accuracy is not up to the mark. Moreover, existing text filtering techniques mainly focus on email spam (Diale, Celik, & Walt, 2019). However, with the popularity of mobile devices, SMS spam and smishing is the one of the major issues these days. Existing approaches mainly focus only on SMS Spam detection. However, there is no efficient technique developed which can efficiently filter out smishing text messages from SMS Spam.

1.4. Objectives

This paper presents a novel machine learning based approach to detect the spam and smishing messages. The paper used effective feature set for detection of spam and smishing messages. The proposed approach is divided into two phases. The first phase distinguishes the spam messages from ham messages using eleven basic features. The second phase filters smishing message from the spam message using four phishing features. The performance of our proposed method is evaluated on various machine learning classifiers using the dataset of ham and spam messages. Followings are the major contributions of the proposed approach:

• •

  Implementation of a classifier for spam and smishing messages.

• •

  Identification of four outstanding phishing features suitable for mobile smishing detection.

• •

  Detection of zero day mobile phishing attacks using the proposed features.

• •

  Utilization of information gain values to get the best features for SMS spam and smishing detection.