Phishing is a type of fraud attempt in which the attacker, usually by e-mail, pretends to be a trusted person or entity in order to obtain sensitive information from a target. Most recent phishing detection researches have focused on obtaining highly distinctive features from the metadata and text of these e-mails. The obtained attributes are then used to feed classification algorithms in order to determine whether they are phishing or legitimate messages. In this paper, it is proposed an approach based on machine learning to detect phishing e-mail attacks. The methods that compose this approach are performed through a feature engineering process based on natural language processing, lemmatization, topics modeling, improved learning techniques for resampling and cross-validation, and hyperparameters configuration. The first proposed method uses all the features obtained from the Document-Term Matrix (DTM) in the classification algorithms. The second one uses Latent Dirichlet Allocation (LDA) as a operation to deal with the problems of the "curse of dimensionality", the sparsity, and the text context portion included in the obtained representation. The proposed approach reached marks with an F1-measure of 99.95% success rate using the XGBoost algorithm. It outperforms state-of-the-art phishing detection researches for an accredited data set, in applications based only on the body of the e-mails, without using other e-mail features such as its header, IP information or number of links in the text.

A phishing attack is a threat based on fraudulent communication, usually by e-mail, where the cybercriminals, impersonating a trusted person or organization, try to lure and coax a target. Phishing detection approaches that obtain highly representational features from the text of these e-mails are a suitable strategy to counter these threats since these features can be used to train machine learning algorithms, thus generating models able to classify mail samples as phishing or legitimate messages. This paper proposes a multi-stage approach to detect phishing e-mail attacks using natural language processing and machine learning. The proposed multi-stage approach consists of feature engineering within natural language processing, lemmatization, feature selection, feature extraction, improved learning techniques for resampling and cross-validation, and the configuration of hyperparameters. We present two methods of the proposed approach, the first one exploiting the Chi-Square statistics and the Mutual Information to improve the dimensionality reduction, while the second method associates Principal Component Analysis (PCA) and Latent Semantic Analysis (LSA). Both methods handle the problems of the “curse of dimensionality", the sparsity, and the amount of information that must be obtained from the context in the Vector Space Model (VSM) representation. These methods yield reduced feature sets that, combined with the XGBoost and Random Forest machine learning algorithms, lead to an F1-measure of 100% success rate, for validation tests with the SpamAssassin Public Corpus and the Nazario Phishing Corpus datasets. Even considering just the text in e-mail bodies, the proposed multi-stage phishing detection approach outperforms state-of-the-art schemes for an accredited data set, requiring a much smaller number of features and presenting lower computational cost.

A segurança cibernética emergiu como uma prioridade estratégica crıtica nas instituições educacionais brasileiras, especialmente diante do crescimento exponencial de ataques direcionados ao setor educacional. Este artigo apresenta um estudo de caso detalhado sobre a implantação do sistema Wazuh no Instituto Federal de Sergipe (IFS), uma solução open-source de monitoramento de segurança da informação que combina funcionalidades SIEM (Security Information and Event Management) e XDR (Extended Detection and Response). O estudo analisa sistematicamente o ambiente pré-implantação, documenta os desafios tecnicos e organizacionais enfrentados durante a implementação e quantifica os benefıcios operacionais adquiridos apos a ferramenta estar completamente operacional. A pesquisa inclui analise quantitativa, por meio de gráficos comparativos e tabelas de conformidade regulatória, demonstrando reduções significativas nos incidentes cibernéticos e melhorias substânciais na eficiência operacional. Os resultados evidenciam melhorias de 85% na detecção de ameaças em tempo real, conformidade total com a LGPD e reduçaõ de 70% no témpo medio de resposta a incidentes.