\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={No Fish; Total Anti-Phishing Protection System},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2020-01-15 (revised: 15 January 2020)}
\def\TheID{\makeatother }
\def\TheDate{2020-01-15}
\title{No Fish; Total Anti-Phishing Protection System}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{R.A.H.Devdunie  Pabasara}

             \author[2]{Dhanushka Niroshan  Atimorathanna}

             \author[3]{Tharindu Shehan  Ranaweera}

             \author[4]{Jayani Rukshila  Perera}

             \affil[1]{  Sri Lanka Institute of Information Technology}

\renewcommand\Authands{ and }

\date{\small \em Received: 10 December 2019 Accepted: 1 January 2020 Published: 15 January 2020}

\maketitle


\begin{abstract}
        


Phishing attacks have been identified by researchers as one of the major cyber-attack vectors which the general public has to face today. Although software companies launch new anti-phishing products, these products cannot prevent all the phishing attacks. The proposed solution, ?No Fish? is a total anti-phishing protection system created especially for end-users as well as for organizations. In this paper, a realtime anti-phishing system, which has been implemented using four main phishing detection mechanisms, is proposed. The system has the following distinguishing properties from related studies in the literature: language independence, use of a considerable amount of phishing and legitimate data,

\end{abstract}


\keywords{cyber-attack, anti-phishing, information security, machine learning, }

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
owadays, with advances in technology, internetrelated crimes have increased at an alarming rate \hyperref[b0]{[1]}. Among these crimes, phishing is one of the most popular cyber-attack vectors, which is a serious threat to information security and especially to the global economy. In phishing attacks, attacker develops web pages mimicking original websites and sends out fake emails, impersonating as a trusted entity such as popular brands or organizations, asking for sensitive information such as username, password, phone number, credit card details and other personal information. Internet users should be aware of phishing attacks as it has been in the cyber domain for years. However, many people still tend to fall victim and leak confidential information through suspicious web pages.\par
There are common ways of fighting phishing attacks. One way is to train employees to recognize the gravity of phishing attacks and their consequences. Awareness plays a crucial role in phishing prevention \hyperref[b1]{[2]}. However, it is not practical to train employees or users on every possible phishing scenario. It is only human nature to be distracted and deceived. The other way is to block domain URLs and IPs, which are known from previous phishing attacks. However, hackers constantly create new domains to hunt fresh IPs \hyperref[b2]{[3]}. The proposed "NoFish" identifies the website which the user is about to visit. It identifies logos and important features of a website using machine learning to detect the website which is being visited by the user. The visual similarity between the legitimate website and the current website is compared to get more accurate results. "NoFish" has an email client plugin for the Microsoft Outlook email client, which is implemented using content-based approaches and client-based programming languages. It should be downloaded to the Microsoft Outlook email client and it detects spam emails and extract URLs from the email body for further analysis. "NoFish" uses different classification algorithms, machine learning (ML), and natural language processing (NLP) based features \hyperref[b3]{[4]}. NLP is proposed for URL analysis. It detects phishing URLs that users are about to visit. When using untrusted internet connections such as public WiFi services, DNS based anti-phishing approach, and HTTPS certificate transparency checking system are used to protect against DNS related phishing attacks \hyperref[b4]{[5]} \hyperref[b5]{[6]}. The system provides a feedback mechanism to enhance user experience through a dashboard. 'NoFish' innovative solution detects all kinds of phishing attacks, including future ones after a super simple deployment next to the user's email client and web browser. It implements a simple email client plug in and browser extension for users. 
\section[{II.}]{II.} 
\section[{Related Work}]{Related Work}\par
Phishing is a major security issue that needs to be addressed. Internet users should be aware of phishing attacks because this has been around for years. However, many domestic users still tend to get tricked by these phishing attempts. Therefore, everyone needed a good software-based solution to overcome this human error. In recent years, industry and academia have proposed several anti-phishing solutions to counter the phishing threat. Some of the important methods are discussed below. 
\section[{a) Document Object Format}]{a) Document Object Format}\par
Document Object Format (DOM) is a languageindependent and cross-platform programming interface for XML, XHTML, and HTML documents \hyperref[b6]{[7]}. The DOM is an object-oriented representation of the web page. The DOM-based phishing detection solutions use the similarity of a DOM tree on a suspicious web page and a legitimate web page to detect phishing. Since attackers always imitate a legitimate web page and create phishing web pages, the layout of the page is expected to be the same. Rosiello et al. have proposed a solution that alerts users when they use the same information on different websites, such as the same username and password \hyperref[b6]{[7]}. 
\section[{b) Content-based comparison}]{b) Content-based comparison}\par
Content-based comparison often attempts to compare the text of a web page through machine learning. Using the TF-IDF, the most used algorithm for extracting text and information from the web page, al. Zhang developed a content-based system to identify phishing websites \hyperref[b7]{[8]}. Basnett et al. Evaluate their performance using various machine learning techniques, including neural networks, SVM (Support Vector Machine), and SOM (Self-Organizing feature Map)  {\ref [8] [9]}. 
\section[{c) Signature-based technique}]{c) Signature-based technique}\par
Huang proposed a unique signature-based method to identify legitimate websites using text keywords and images on the website \hyperref[b9]{[10]}. The system compares the signature of the currently open website with the signature database when a user tries to log in to a new website. If the domain name is changed but the signature matches, the web page will be declared as phishing. When a user visits a website for the first time, the system generates the signature and saves it to the database. Therefore this detection only works for the previously visited website sites, and it cannot detect zero-hour phishing attacks. 
\section[{d) Phish Zoo}]{d) Phish Zoo}\par
Afros and Greens tad have proposed a phishing detection solution called "Phish Zoo" that creates a unique profile for a website using URL, images, text content, secure connection layer (SSL) certification, and script \hyperref[b10]{[11]}. When a user visits a website, Phish Zoo matches the current site profile with a list of legitimate sites and profiles stored in the database. As a first step, the URL and SSL certificate is compared with the stored profile. If it matches, the website is considered legitimate by Phish Zoo. Otherwise, the site's contents will be matched against appearance profiles to detect phishing attempts. 
\section[{III.}]{III.} 
\section[{Proposed Solution}]{Proposed Solution}\par
In this section, the proposed phishing detection approach is explained. Phishing attacks have evolved a lot in past years such that even experienced users sometimes cannot be able to distinguish between phishing and legitimate pages. The proposed solution uses a level-based detection mechanism to identify phishing attacks in order to reduce the computational power and time consumption. Therefore it increases the performance and accuracy of the overall product than existing systems. Further, it provides protection against phishing attacks on trusted and untrusted internet connection. If the user is using an untrusted internet connection such as public WiFi, then the system checks the trustworthiness of the DNS servers \hyperref[b4]{[5]} [12] \hyperref[b12]{[13]}. Otherwise, it will be forwarded to the usual phishing detection mechanism. The system architecture is proposed under six main components. They are namely: NoFish uses a level-based security mechanism to detect phishing attacks. Researches have designed it in such a manner to reduce the computational power, reduce the time consumption of the NoFish clients, and to increase the performance and accuracy of the overall product. Figure \hyperref[fig_0]{1} depicts the flow chart of the proposed system. As a first step URL will be matched with the white-list and black-list databases. The system uses this approach to identify known phishing sites, and if it is a white-listed URL, the system allows the user to visit the website. If the URL does not exist in those databases, it will be sent to the URL analyzer. Then the URL analyzer will be predicted as a legitimate or phishing URL. Based on the prediction, the system will deny the website or moves to the webpage similarity comparison stage.? Browser Extension ? URL Analysis ? Image Processing ? Email Phishing Detection ? DNS Phishing ? Feedback Mechanism\par
IV. 
\section[{Browser Extention}]{Browser Extention}\par
The system has a browser extension for the Chrome web browser that must be downloaded by the user. This plays a major role in system performance, which is explained below a) Customized Whitelist and Blacklist Users can categorize websites into a white list or black-list through the extension, and it will be saved in the extension. When the user is bookmarking a website, it will automatically be added to the user-customized white-list within the extension once the phishing detection is completed. Consequently, the extension itself can allow or deny accessing a website without check with the server-side. 
\section[{b) Extracting the URL}]{b) Extracting the URL}\par
Extracting URL from the website the user is trying to visit is done by the extension and then it is forwarded to the NoFish server for further analysis. 
\section[{Capturing Image of the Current Website}]{Capturing Image of the Current Website}\par
The extension takes a screenshot of the current web site and redirects it to the NoFish server. The current web page image is required for log detection and web page similarity comparison; hence the screenshot is forwarded to the analysis.\par
V. 
\section[{Url Analysis}]{Url Analysis}\par
Many systems have been implemented to detect URL phishing attacks, and some of them have been focused mainly on email-based URL attacks only. However, phishing URLs can reach the victim in various ways. Nowadays, social media has become a major vector for phishing links. Very few of the existing solutions are still based on the old method, which is based on black-listing, and there are only a few existing systems that can-do real-time URL analysis to detect phishing attacks \hyperref[b13]{[14]}  \hyperref[b14]{[15]}. However, they depend on language and algorithms that have been used to implement the system. The main purpose of implementing a URL analysis system such as NoFish is to detect any kind of phishing URL and secure the endusers as well as the organizations from phishing attacks better than prevailing solutions. 
\section[{a) NoFish URL Analyzer}]{a) NoFish URL Analyzer}\par
NoFish users can manage their own customized URL database in the extension. Therefore NoFish URL analyzer will not check URLs, which are in customized white-list and black-list available in the user browser extension, and it gives direct access to those sites. When a user browses a URL, which is not in customized data storage, the system request from the server to check it with a white-listed and a black-listed database. NoFish is not storing these databases, and it directly connects with the "Alexa" database and "Phish-Tank" database, and it uses their APIs to check the status of the URL. Alexa (Legitimate URLs) and Phish Tank (Phishing URLs) already maintain large databases orderly and authors believe it gives a better result and reduces the time to check compared to maintaining our own databases. However, according to user feedback, NoFish is maintaining its own white-listed and black-listed database to personalize the service. The database is automatically updated according to user feedback. If that URL is not belonging to one of them, that means it is a newly identified URL from the analyzer. That URL goes through the trained machine learning model and give predictions whether it is phishing or legitimate. The system shows a warning to the user if the URL is phishing. Users can acknowledge and not continue or ignore the warning. If the model gives it as a legitimate URL, it is then immediately moved to the image classification and computer vision process. 
\section[{b) Algorithms and Model}]{b) Algorithms and Model}\par
URL analysis is a common subject in the information security domain. There are so many existing projects on phishing detection on URL analysis and have used deep neural networks. However, NoFish has simply created its analyzer using Machine Learning (ML) approach after extensive research on several existing URL analyzers. It consists of Machine Learning algorithms and Natural Language Processing (NLP)  {\ref [4] [14]}. For measuring the performance of the system, a new dataset of phishing and legitimate URLs was constructed, and the experimental results were tested on them. NoFish have used Random Forest Classifier, Decision Tree Classifier, Logistic Regression Classifier, Support Vector Machine (SVM), and Naive Bayes algorithm with NLP feature and have done modifications and fine-tuning to create a higher accuracy model \hyperref[b15]{[16]}. NoFish uses 13 features of URLs for identifying phishing patterns of a URL such as protocol, domain, path, having IP, long URL, short URL, redirection, prefix\textunderscore suffixseparation, sub domain, google index, DNS records, and https token. Test results are discussed in the test results section. 
\section[{VI. Computer Vision for Phishing Detection}]{VI. Computer Vision for Phishing Detection}\par
This is one of the most important stages in the system, and the goal is to categorize websites to make it easier to compare with the legitimate website layouts \hyperref[b16]{[17]}. Figure \hyperref[fig_2]{2} depicts how the system uses computer vision to identify the current website. 
\section[{a) Logo Detection}]{a) Logo Detection}\par
For this prototype, the logo detector can identify 20 image classes, including the most popular banks in Sri Lanka, and mostly used international websites. The logo detection model was trained using the Tensor Flow software library on Google Colab. NoFish team trained several Tensor Flow object detection models \hyperref[b15]{[16]} with our own dataset, and in every case, it returned the same accuracy levels. Those models are mentioned in the test results section, along with the accuracy rates obtained.\par
Since the website login pages are not very complex images, the model can classify the logos with high accuracy. Therefore, we selected  NoFish has developed this algorithm using the OpenCV python library to identify the similarity between the current website and the legitimate website. First, the algorithm identifies key points in both images and compares them to identify matching key points. Then defines a rating of similarity from 0 to 10, where 0 means they are completely different and 10 means they are perfectly matched. Based on the score, the system defines security levels. If the score is greater than 5 it defines as a high possibility, and if the score is greater than 3 and lower than 5 it will define as low possibility. 
\section[{Global}]{Global}\par
Then the system returns a warning to the user accordingly, as depicted in Figure \hyperref[fig_3]{3}.  
\section[{Email Phishing Detection}]{Email Phishing Detection}\par
Email phishing is a type of online scam where criminals ask users to provide sensitive information. This is mostly done by including a link that will appear to take you to the website that appears to be from a legitimate company; however, the website is bogus. About 70\% of phishing scandals involve national-state or stateaffiliated actors, according to the Verizon 2018 Data Breach Investigations Report  {\ref [18]}. Phishing continues to be effective, more sophisticated, targeted, and difficult to identify. 4\% of targeted people will click on the attachment, 94\% of the time when the attachment is malicious. Only 17\% of attacks are reported, and it usually takes 30 minutes to report. The cost of phishing for American businesses continues to grow, to more than half a billion dollars last year \hyperref[b0]{[1]}. The email plugin detects spam emails for preventing the spams which are used by the phishers for attacks, and the plugin detects all the URLs in the email body to redirect to the existing URL analysis component to detect any phishing URLs. Detected spam emails are sent to the junk email folder, and phishing emails are blocked for users to view. A warning message will be notified for users about the phishing threat. The Yeoman generator, which is built with node.js, is used to create outlook add-in. 
\section[{a) Proposed Model for Email Phishing Detection}]{a) Proposed Model for Email Phishing Detection} 
\section[{Detect spam emails}]{Detect spam emails}\par
NoFish system detects for spam emails because phishing emails are also received as spams. It uses an algorithm called Naïve Bayes Classifier to detect if the email is spam or not \hyperref[b15]{[16]}. Naïve Bayes is part of a large Natural Language Processing toolset and can be trained better when fed with many and complete spam emails \hyperref[b15]{[16]} \hyperref[b17]{[19]}. They usually use a word bag to identify spam emails, a common approach to text sorting. Naive Bayes classification works by associating tokens (usually words, or perhaps other things), spam and non-spam emails, and using Bayes' theorem to calculate the probability that an email is not spam \hyperref[b18]{[20]}. This spam filter accesses the email account using the IMAP protocol. We experienced that most of the time, spam mostly comes from Chinese email hosts. Therefore, as a special feature, we use a function to scan all the characters in the subject text. It triggers on any character that falls into the Han Ideographs Unicode Range. It simply scans the complete range for Chinese characters in Unicode and detect if it is spam or not.\par
Bayes classifier sets up two categories to choose from. It contains possible spam sentences, phrases, and word-lists, which are weighted against a white list. This returns its verdict as either "spam" or "mail". It is implemented to open the folder named spam on the email account and delete all emails older than ten days.\par
Our team has tested both the Naïve Bayes Algorithm \hyperref[b18]{(20)} and Support Vector Machine (SVM) algorithms to detect spam emails. According to the test results, the Naïve Bayes Algorithm was used to detect spam emails. Test results are discussed in the section test results. 
\section[{Detect phishing URLs in emails}]{Detect phishing URLs in emails}\par
JavaScript libraries are used to detect URLs in the email body. URLs may hide in emails in several ways as attachments, texts, images etc. These URLs are detected and redirect to the existing system called URL Analysis to determine the URL is phishing or not. If the URL is phishing, the user is notified by a popup message and blocked the phishing email for viewing. Since the NoFish has an existing system to analyze phishing URLs in advance, the accuracy of detect phishing URLs in high. It protects users from zero-day phishing attacks \hyperref[b1]{[2]}. 
\section[{VIII.}]{VIII.} 
\section[{Interactive Dashboard}]{Interactive Dashboard}\par
NoFish system provides a user interactive dashboard to enhance the user experience. Users may use the interactive dashboard through the official site. It provides features for the user to explore more services that are provided by NoFish systems, such as feedback mechanism. Users can vote for black-listed URLs to verify it as a phishing or malicious website. This may be used after installing NoFish extension to the web browser. 
\section[{IX.}]{IX.} 
\section[{Detecting Dns Based Attacks}]{Detecting Dns Based Attacks}\par
When the user is connecting to a WiFi network first, the system checks whether it was saved in the user's computer. If it is a saved WiFi system, assume that it is a trusted connection. When the user is connecting to a new WiFi network, then the system checks whether the WiFi connection requires a WPA or WPA2 password. If not it is probably not secure. Further, to identify accurately, the system will ask the user whether it is public WiFi or trusted WiFi. If the WiFi is identified as untrusted, then the system will check for DNS related phishing attacks \hyperref[b11]{[12]}. To identifying a fake DNS author \hyperref[b5]{[6]} [5], proposed a solution that gives the IP address of the domain name of the current website using the IP Lookup API. Then using that IP address, the system can do a reverse IP lookup from the server-side and get the domain name, and by that, the system will define the DNS server is malicious or not \hyperref[b11]{[12]}[5]. 
\section[{X.}]{X.} 
\section[{Test Results}]{Test Results}\par
In order to choose a model for logo detection our team trained several pertained models chosen from Tensor Flow object detection API with our own data set. Those models are mentioned below, along with the accuracy rates obtained. According to past researches, SVM, and Naïve Bayes has more accuracy than other algorithms when detecting spam emails \hyperref[b15]{[16]} \hyperref[b8]{[9]}. Within our calculation, SVM got 91.67\%, and Naïve Bayes got 91.47\% of accuracies, which shows the same accuracies. However, our team has identified SVM might not fast as other classification algorithms. Naïve Bayes classifier simply applies Bayes' theorem on the context of each email, with a strong assumption that the words included in the email are independent of each other. Therefore, NoFish has used the Naïve Bayes algorithm for spam detection with more success. 
\section[{XI. Conclusion and Recommendations}]{XI. Conclusion and Recommendations}\par
In order to prevent phishing, business and consumers need to educate themselves about phishing and anti-phishing techniques. They should use current protection methods and report suspicious activities. By doing so, they can reduce their exposure to fraud and identity theft and protect their privacy. The most effective solution for phishing is to train users not to blindly follow links to websites that need to include sensitive information such as passwords. The ultimate technological solution to phishing is the significant infrastructure changes on the Internet that exceed the ability of any organization to deploy. However, there are steps that can now be taken to reduce the consumer's risk of phishing attacks. Some of those steps are:\par
For Corporations ? Provide a way for the consumer to validate that the email is legitimate. ? Stronger authentication on websites and emails.\par
? Implement a good quality anti-virus, anti-spam, and content filtering solutions at the internet gateway.\par
For Consumers Be suspicious.\par
? Automatically detect and block malicious emails, websites, URLs, and DNS servers. ? Automatically block sensitive information from leaking to malicious parties.\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-3.png}
\caption{\label{fig_1}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Figure 3 :}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{} \par 
\begin{longtable}{P{0.85\textwidth}}
? Faster\textunderscore rcnn\textunderscore inception\textunderscore v2\textunderscore coco model has a\\
running time of 58ms per 600x600 image with mAP\\
{}[\textasciicircum 1] measure of 28 -over 95\% accuracy.\\
? Ssd\textunderscore mobilenet\textunderscore v2\textunderscore coco model has a running time\\
of 31ms per 600x600 image with mAP [\textasciicircum 1]\\
measure of 22 -over 95\% accuracy.\\
? Faster\textunderscore rcnn\textunderscore inception\textunderscore resnet\textunderscore v2\textunderscore atrous\textunderscore coco\\
model has a running time of 620ms per 600x600\\
image with mAP [\textasciicircum 1] measure of 37 -over 95\%\\
accuracy.\\
When evaluating the URL analyzer, all the\\
algorithms were tested separately with large phishing\\
and legitimate data sets and Random Forest Classifier\\
{}[21][22] returned 96.257\%, Decision Tree Classifier\\
returned 84.119\%, Logistic Regression Classifier\\
returned 91.037\%, Support Vector Machine returned\\
91.002\%, and Navy Bayes returned 94.128\% accuracies\\
respectively. Consequently, in order to obtain a better\\
accuracy level,\end{longtable} \par
 
\caption{\label{tab_0}}\end{figure}
 			\footnote{Year 2020 ( ) E © 2020 Global Journals No Fish; Total Anti-Phishing Protection System} 			\footnote{© 2020 Global JournalsNo Fish; Total Anti-Phishing Protection System} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Berger and Merkl ()]{b8}\label{b8} 	 		‘A comparison of support vector machines and self-organizing maps for email categorization’.  		 			H Berger 		,  		 			D Merkl 		.  	 	 		\textit{Aus DM 2005 Proc. -4th Australas. Data Min. Conf. -Collocated with 18th Aust. Jt. Conf. Artif. Intell. AI 2005 2nd Aust. Conf. Artifical Life, ACAL 2005},  				2005. p. .  	 
\bibitem[Rosiello et al. ()]{b6}\label{b6} 	 		‘A layout-similarity-based approach for detecting phishing pages’.  		 			P E Rosiello 		,  		 			E Kirda 		,  		 			C Kruegel 		,  		 			F Ferrandi 		.  		 \xref{http://dx.doi.org/10.1109/SECCOM.2007.4550367}{10.1109/SECCOM.2007.4550367}.  	 	 		\textit{Proceedings of the 3rd International Conference on Security and Privacy in Communication Networks},  				 (the 3rd International Conference on Security and Privacy in Communication Networks)  		2007. p. .  	 
\bibitem[Islam and Abawajy (2013)]{b18}\label{b18} 	 		‘A multi-tier phishing detection and filtering approach’.  		 			R Islam 		,  		 			J Abawajy 		.  		 \xref{http://dx.doi.org/10.1016/j.jnca.2012.05.009}{10.1016/j.jnca.2012.05.009}.  	 	 		\textit{J. Netw. Comput. Appl}  		Jan. 2013. 36  (1)  p. .  	 
\bibitem[Gajera et al. ()]{b11}\label{b11} 	 		‘A Novel Approach to Detect Phishing Attack Using Artificial Neural Networks Combined with Pharming Detection’.  		 			K Gajera 		,  		 			M Jangid 		,  		 			P Mehta 		,  		 			J Mittal 		.  		 \xref{http://dx.doi.org/10.1109/ICECA.2019.8822053}{10.1109/ICECA.2019.8822053}.  	 	 		\textit{Proceedings of the 3rd International Conference on Electronics and Communication and Aerospace Technology},  				 (the 3rd International Conference on Electronics and Communication and Aerospace Technology)  		2019. p. .  	 
\bibitem[Lakhita et al. ()]{b0}\label{b0} 	 		‘A review on recent phishing attacks in Internet’.  		 			S Lakhita 		,  		 			B Yadav 		,  		 			Pooja Bohra 		.  		 \xref{http://dx.doi.org/10.1109/ICGCIoT.2015.7380669}{10.1109/ICGCIoT.2015.7380669}.  	 	 		\textit{Proceedings of the 2015 International Conference on Green Computing and Internet of Things},  				 (the 2015 International Conference on Green Computing and Internet of Things)  		ICGCIoT 2015, 2016. p. .  	 
\bibitem[An Image-based Feature Extraction Approach for Phishing Website Detection]{b19}\label{b19} 	 		\textit{An Image-based Feature Extraction Approach for Phishing Website Detection},  		 	 	 (Usenix-security-submission) 
\bibitem[Zhu et al. (2015)]{b12}\label{b12} 	 		‘Connection-oriented DNS to improve privacy and security’.  		 			L Zhu 		,  		 			Z Hu 		,  		 			J Heidemann 		,  		 			D Wessels 		,  		 			A Mankin 		,  		 			N Somaiya 		.  		 \xref{http://dx.doi.org/10.1109/SP.2015.18}{10.1109/SP.2015.18}.  	 	 		\textit{Proceedings -IEEE Symposium on Security and Privacy},  				 (-IEEE Symposium on Security and Privacy)  		2015. 2015-July. p. .  	 
\bibitem[Kim and Huh ()]{b4}\label{b4} 	 		‘Detecting DNS-poisoningbased phishing attacks from their network performance characteristics’.  		 			H Kim 		,  		 			J H Huh 		.  		 \xref{http://dx.doi.org/10.1049/el.2011.0399}{10.1049/el.2011.0399}.  	 	 		\textit{Electronics Letters}  		2011. 47  (11)  p. .  	 
\bibitem[Hsu et al. ()]{b7}\label{b7} 	 		‘Identify fixed-path phishing attack by STC’.  		 			H Hsu 		,  		 			P Wang 		,  		 			S Pu 		.  		 \xref{http://dx.doi.org/10.1145/2030376.2030396}{10.1145/2030376.2030396}.  	 	 		\textit{ACM International Conference Proceeding Series},  				2011. p. .  	 
\bibitem[Carella et al. ()]{b1}\label{b1} 	 		‘Impact of security awareness training on phishing clickthrough rates’.  		 			M Carella 		,  		 			T M Kotsoev 		,  		 			Truta 		.  		 \xref{http://dx.doi.org/10.1109/BigData.2017.8258485}{10.1109/BigData.2017.8258485}.  	 	 		\textit{Proceedings -2017 IEEE International Conference on Big Data},  				 (-2017 IEEE International Conference on Big Data)  		2017, 2017. 2018-January. p. .  	 
\bibitem[Subasi et al. ()]{b20}\label{b20} 	 		‘Intelligent phishing website detection using random forest classifier’.  		 			A Subasi 		,  		 			E Molah 		,  		 			F Almkallawi 		,  		 			T J Chaudhery 		.  		 \xref{http://dx.doi.org/10.1109/ICECTA.2017.8252051}{10.1109/ICECTA.2017.8252051}.  	 	 		\textit{2017 International Conference on Electrical and Computing Technologies and Applications},  				2017, 2017. 2018-January. p. .  	 
\bibitem[Sahingoz et al. (2019)]{b13}\label{b13} 	 		‘Machine learning based phishing detection from URLs’.  		 			O K Sahingoz 		,  		 			E Buber 		,  		 			O Demir 		,  		 			B Diri 		.  		 \xref{http://dx.doi.org/10.1016/j.eswa.2018.09.029}{10.1016/j.eswa.2018.09.029}.  	 	 		\textit{Expert Syst. Appl}  		Mar. 2019. 117 p. .  	 
\bibitem[Huang et al.]{b9}\label{b9} 	 		‘Mitigate web phishing using site signatures’.  		 			Y Huang 		,  		 			S P Ma 		,  		 			W L Yeh 		,  		 			C Y Lin 		,  		 			C T Liu 		.  		 \xref{http://dx.doi.org/10.1109/TENCON.2010.5686582}{10.1109/TENCON.2010.5686582}.  	 	 		\textit{IEEE Region 10 Annual International Conference, Proceedings/TENCON, 2010},  				p. .  	 
\bibitem[Buber et al. ()]{b3}\label{b3} 	 		‘NLP Based Phishing Attack Detection from URLs’.  		 			E Buber 		,  		 			B Diri 		,  		 			O K Sahingoz 		.  		 \xref{http://dx.doi.org/10.1007/978-3-319-76348-4_59}{10.1007/978-3-319-76348-4\textunderscore 59}.  	 	 		\textit{Advances in Intelligent Systems and Computing},  				2018. 736 p. .  	 
\bibitem[Afroz and Greenstadt ()]{b10}\label{b10} 	 		‘Phish Zoo: Detecting phishing websites by looking at them’.  		 			S Afroz 		,  		 			R Greenstadt 		.  		 \xref{http://dx.doi.org/10.1109/ICSC.2011.52}{10.1109/ICSC.2011.52}.  	 	 		\textit{Proceedings -5th IEEE International Conference on Semantic Computing},  				 (-5th IEEE International Conference on Semantic Computing)  		2011, 2011. p. .  	 
\bibitem[Fang et al. ()]{b17}\label{b17} 	 		‘Phishing Email Detection Using Improved RCNN Model With Multilevel Vectors and Attention Mechanism’.  		 			Y Fang 		,  		 			C Zhang 		,  		 			C Huang 		,  		 			L Liu 		,  		 			Y Yang 		.  		 \xref{http://dx.doi.org/10.1109/ACCESS.2019.2913705}{10.1109/ACCESS.2019.2913705}.  	 	 		\textit{IEEE Access}  		2019. 7 p. .  	 
\bibitem[Kiruthiga and Akila ()]{b14}\label{b14} 	 		‘Phishing websites detection using machine learning’.  		 			R Kiruthiga 		,  		 			D Akila 		.  		 \xref{http://dx.doi.org/10.35940/ijrte.B1018.0982S1119}{10.35940/ijrte.B1018.0982S1119}.  	 	 		\textit{Int. J. Recent Technol. Eng}  		2019. 8  (2)  p. .  	 	 (Special Issue 11) 
\bibitem[Tewari et al. (2016)]{b2}\label{b2} 	 		‘Recent survey of various defense mechanisms against phishing attacks’.  		 			A K Tewari 		,  		 			B B Jain 		,  		 			Gupta 		.  		 \xref{http://dx.doi.org/10.1080/15536548.2016.1139423}{10.1080/15536548.2016.1139423}.  	 	 		\textit{J. Inf. Priv. Secur}  		Jan. 2016. 12  (1)  p. .  	 
\bibitem[Yang et al. ()]{b15}\label{b15} 	 		‘Spam filtering using Association Rules and Naïve Bayes Classifier’.  		 			T Yang 		,  		 			K Qian 		,  		 			D C T Lo 		,  		 			K Al Nasr 		,  		 			Y Qian 		.  		 \xref{http://dx.doi.org/10.1109/PIC.2015.7489926}{10.1109/PIC.2015.7489926}.  	 	 		\textit{Proceedings of 2015 IEEE International Conference on Progress in Informatics and Computing},  				 (2015 IEEE International Conference on Progress in Informatics and Computing)  		2015. 2016. p. .  	 
\bibitem[Hara et al. (2009)]{b16}\label{b16} 	 		‘Visual similarity-based phishing detection without victim site information’.  		 			M Hara 		,  		 			A Yamada 		,  		 			Y Miyake 		.  		 \xref{http://dx.doi.org/10.1109/CICYBS.2009.4925087.18}{10.1109/CICYBS.2009.4925087.18}.  		 \url{https://www.darkreading.com/threat-intelligence/14-million-new-phishing-sites-launched-each-month/d/d-id/1329955}  	 	 		\textit{2009 IEEE Symposium on Computational Intelligence in Cyber Security},  				2009. Feb-2020. p. 23.  	 	 (1.4 Million New Phishing Sites Launched Each Month) 
\bibitem[Vulnerabilities ()]{b5}\label{b5} 	 		 			"dns Vulnerabilities 		.  		\textit{DNS Security Management},  				2017. John Wiley \& Sons, Inc. p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
