CIC-Trap4Phish: 一种统一的多格式数据集用于钓鱼和Quishing附件检测
CIC-Trap4Phish: A Unified Multi-Format Dataset for Phishing and Quishing Attachment Detection
AI总结：
CIC-Trap4Phish 提出了一种统一的多格式数据集，用于提升钓鱼和Quishing附件检测的准确性和鲁棒性。
摘要：
钓鱼攻击代表了网络攻击者使用的一种主要攻击方法。在许多情况下，攻击者会使用欺骗性电子邮件和恶意附件来诱骗用户泄露敏感信息或安装恶意软件，同时破坏整个系统。恶意电子邮件附件的灵活性使其成为攻击者偏好的传播媒介，因为它们可以将恶意内容如恶意软件或恶意URL嵌入标准文档格式中。尽管钓鱼电子邮件防御措施已显著提高，但攻击者仍然利用附件，使恶意内容能够绕过安全措施。此外，研究人员在训练高级模型时面临的另一个挑战是缺乏一个统一且全面的数据集，该数据集涵盖了最普遍的数据类型。为了解决这一差距，我们生成了CIC-Trap4Phish，一个多格式数据集，包含恶意和良性样本，涵盖五种在钓鱼攻击中常用的文件类型：Microsoft Word文档、Excel电子表格、PDF文件、HTML页面和二维码图像。对于前四种文件类型，提出了一套无需执行的静态特征管道，旨在捕捉结构、词汇和元数据指标，而无需打开或执行文件。特征选择通过SHAP分析和特征重要性相结合的方法进行，得到每种文件类型的紧凑、判别性特征子集。所选特征通过使用轻量级机器学习模型进行评估，包括随机森林、XGBoost和决策树。所有模型在各种格式上均表现出高检测准确性。对于基于二维码的钓鱼（Quishing），实现了两种互补方法：基于图像的检测通过使用卷积神经网络（CNNs）进行，以及通过解码URL的词法分析使用最近的轻量级语言模型。
英文摘要：
Phishing attacks represents one of the primary attack methods which is used by cyber attackers. In many cases, attackers use deceptive emails along with malicious attachments to trick users into giving away sensitive information or installing malware while compromising entire systems. The flexibility of malicious email attachments makes them stand out as a preferred vector for attackers as they can embed harmful content such as malware or malicious URLs inside standard document formats. Although phishing email defenses have improved a lot, attackers continue to abuse attachments, enabling malicious content to bypass security measures. Moreover, another challenge that researches face in training advance models, is lack of an unified and comprehensive dataset that covers the most prevalent data types. To address this gap, we generated CIC-Trap4Phish, a multi-format dataset containing both malicious and benign samples across five categories commonly used in phishing campaigns: Microsoft Word documents, Excel spreadsheets, PDF files, HTML pages, and QR code images. For the first four file types, a set of execution-free static feature pipeline was proposed, designed to capture structural, lexical, and metadata-based indicators without the need to open or execute files. Feature selection was performed using a combination of SHAP analysis and feature importance, yielding compact, discriminative feature subsets for each file type. The selected features were evaluated by using lightweight machine learning models, including Random Forest, XGBoost, and Decision Tree. All models demonstrate high detection accuracy across formats. For QR code-based phishing (quishing), two complementary methods were implemented: image-based detection by employing Convolutional Neural Networks (CNNs) and lexical analysis of decoded URLs using recent lightweight language models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
