A Multi-Agent Case-Based Reasoning Architecture for Phishing Detection

Security threats are becoming very sophisticated and pervasive everywhere. Phishing threats in particular has a changeable nature and short life cycle that complicates the detection process. In this paper, we introduce a Multi-Agent System (MAS) as an adaptive intelligent technique that acts on top of distributed Case-Based Reasoning (CBR) Phishing Detection Systems (CBR-PDSs) as a Phishing Detection System Architecture (PDSA) that runs on large scale globally to constitute a robust worldwide Phishing Threat Intelligence (PTI) environment. The global collaborations of PTI introduces a proactive phishing detection technique, quarantines phishing threats via global threats sharing, and minimizes users' susceptibilities to hard-to-detect spear or advanced phishing attacks. Also, combining two intelligent systems in a unified interactive architecture facilitates the prediction process, increases the accuracy rate, easily tackles the dynamic and changeable behaviors of advanced phishing threats, and minimizes the false negative rate as well. The proposed architecture illustrates the consolidated interaction between intelligent agents and distributed CBR-PDSs in a PTI framework. (c) 2017 The Authors. Published by Elsevier B.V.