Volume 8, Issue 2 2019 ISSN: 2305-0012 (online) International Journal of Cyber-Security and Digital Forensics 2019 ` Overview Editors-in-Chief The International Journal of Cyber-Security and Digital Forensics (IJCSDF) is a knowledge resource for practitioners, scientists, and researchers Dragan Perakovic, University of Zagreb, Croatia among others working in various fields of Cyber Security, Privacy, Trust, Digital Forensics, Hacking, and Cyber Warfare. We welcome original contributions as high quality technical papers (full and short) describing original unpublished results of theoretical, empirical, conceptual or experimental research. All submitted papers will be peer-reviewed by Editorial Board members of the editorial board and selected reviewers and those accepted will be published in the next volume of the journal. Ali Sher, American University of Ras Al Khaimah, UAE Altaf Mukati, Bahria University, Pakistan As one of the most important aims of this journal is to increase the Andre Leon S. Gradvohl, State University of Campinas, Brazil usage and impact of knowledge as well as increasing the visibility and Azizah Abd Manaf, Universiti Teknologi Malaysia, Malaysia ease of use of scientific materials, IJCSDF does NOT CHARGE authors for Bestoun Ahmed, University Sains Malaysia, Malaysia any publication fee for online publishing of their materials in the journal Carl Latino, Oklahoma State University, USA and does NOT CHARGE readers or their institutions for accessing to the Dariusz Jacek Jakóbczak, Technical University of Koszalin, Poland published materials! Duc T. Pham, University of Bermingham, UK E.George Dharma Prakash Raj, Bharathidasan University, India Elboukhari Mohamed, University Mohamed First, Morocco Eric Publisher Atwell, University of Leeds, United Kingdom The Society of Digital Information and Wireless Communications Eyas El-Qawasmeh, King Saud University, Saudi Arabia Ezendu Ariwa, London Metropolitan University, United Kingdom Miramar Tower, 13 Nathan Road, Tsim Sha Tsui, Kowloon, Hong Kong Fouzi Harrag, UFAS University, Algeria Genge Bela, University of Targu Mures, Romania Further Information Guo Bin, Institute Telecom & Management SudParis, France Website: http://sdiwc.net/ijcsdf, Email: [email protected], Hadj Hamma Tadjine, Technical university of Clausthal, Germany Hassan Tel.: (202)-657-4603 - Inside USA; 001(202)-657-4603 - Outside USA. Moradi, Qualcomm Inc., USA Isamu Shioya, Hosei University, Japan Permissions Jacek Stando, Technical University of Lodz, Poland International Journal of Cyber-Security and Digital Forensics (IJCSDF) is Jan Platos, VSB-Technical University of Ostrava, Czech Republic an open access journal which means that all content is freely available Jose Filho, University of Grenoble, France without charge to the user or his/her institution. Users are allowed to Juan Martinez, Gran Mariscal de Ayacucho University, Venezuela Kaikai Xu, University of Electronic Science and Technology of China, China read, download, copy, distribute, print, search, or link to the full texts of Khaled A. Mahdi, Kuwait University, Kuwait the articles in this journal without asking prior permission from the Ladislav Burita, University of Defence, Czech Republic publisher or the author. This is in accordance with the BOAI definition of Maitham Safar, Kuwait University, Kuwait open access. Majid Haghparast, Islamic Azad University, Shahre-Rey Branch, Iran Martin J. Dudziak, Stratford University, USA Disclaimer Mirel Cosulschi, University of Craiova, Romania Monica Vladoiu, PG University of Ploiesti, Romania Statements of fact and opinion in the articles in the International Journal Nan Zhang, George Washington University, USA of Cyber-Security and Digital Forensics (IJCSDF) are those of the Noraziah Ahmad, Universiti Malaysia Pahang, Malaysia respective authors and contributors and not of the International Journal Pasquale De Meo, University of Applied Sciences of Porto, Italy of Cyber-Security and Digital Forensics (IJCSDF) or The Society of Digital Paulino Leite da Silva, ISCAP-IPP University, Portugal Information and Wireless Communications (SDIWC). Neither The Society Piet Kommers, University of Twente, The Netherlands of Digital Information and Wireless Communications nor International Radhamani Govindaraju, Damodaran College of Science, India Ramadan Journal of Cyber-Security and Digital Forensics (IJCSDF) make any Elaiess, University of Benghazi, Libya representation, express or implied, in respect of the accuracy of the material in this journal and cannot accept any legal responsibility or Rasheed Al-Zharni, King Saud University, Saudi Arabia liability as to the errors or omissions that may be made. The reader Talib Mohammad, University of Botswana, Botswana should make his/her own evaluation as to the appropriateness or Tutut Herawan, University Malaysia Pahang, Malaysia otherwise of any experimental technique described. Velayutham Pavanasam, Adhiparasakthi Engineering College, India Viacheslav Wolfengagen, JurInfoR-MSU Institute, Russia Waralak V. Siricharoen, University of the Thai Chamber of Commerce, Thailand Copyright © 2019 sdiwc.net, All Rights Reserved Wen-Tsai Sung, National Chin-Yi University of Technology, Taiwan Wojciech Zabierowski, Technical University of Lodz, Poland The issue date is June 2019 Su Wu-Chen, Kaohsiung Chang Gung Memorial Hospital, Taiwan Yasin Kabalci, Nigde University, Turkey Yoshiro Imai, Kagawa University, Japan Zanifa Omary, Dublin Institute of Technology, Ireland Zuqing Zhu, University of Science and Technology of China, China ISSN: 2305-0012 (online) International Journal of Cyber-Security and Digital Forensics 2019 Volume 8, Issue 2 Detection of Phishing Emails with Email Forensic Analysis and Machine Learning Techniques..................................................98 Author/s: Kamran Morovati, Sanjay S.Kadam Towards Cross-platform Detection of Cyberattacks Using Micro-agents....................................................................................108 Author/s: Xinxing Zhao, Chandra Sekar Veerappan, Peter Loh, Caleb Wee Detecting Shill Bidding Using eBay’s 30-Day Bid Summary ......................................................................................................120 Author/s: Nathan Fisher, Jarrod Trevathan, Heather Gray Anti-Qrishing Real-Time Technique on the QR Code Using the Address Bar-Based and Domain-Based Approach on Smartphone ...............................................................................................................................................................................134 Author/s: Kurniadin Abd. Latif, Bambang Sugiantoro, Yudi Prayudi Preventing IP Spoofing Attacks in a Shared Resources Network ..........................................................................................144 Author/s: Hussein Sudi Lema, Fatuma Simba Security Modeling for Protecting Electronic Patients’ Consent ................................................................................................152 Author/s: Kosmas Kapis, Emmanuel Damas Cyber SecurityPlatform Solution Based on the Facial Image and Fingerprint..........................................................................166 Author/s: Sulaiman Alshebli, Fatih Kurugollu, Mahmoud Shafik International Journal of Cyber-Security and Digital Forensics (IJCSDF) 8(2): 98-107 The Society of Digital Information and Wireless Communications (SDIWC), 2019 ISSN: 2305-001 Detection of Phishing Emails with Email Forensic Analysis and Machine Learning Techniques Kamran Morovati, Sanjay S.Kadam IT Security and Risk Management Unit, Service Center for Development of Advance New Brunswick Computing (CDAC) Fredericton, NB, Canada Pune, Maharashtra, India [email protected] [email protected] Abstract: This research is an attempt to investigate the Phishing attacks are divided into the following types [3]: effectiveness of email forensic analysis and text mining • Spear Phishing: instead of sending thousands of techniques in identifying phishing emails. The dataset that is emails, an attacker aims at targeting specific individuals used for this experiment consist of suspicious emails reported within a company who probably have access to sensitive by our clients that were delivered in their inboxes and hence information. our anti-spam solution was not able to detect them. • Whaling phishing: is a specific type of phishing In this paper, the importance of inspecting the email header attack that targets high-profile employees, such as the fields and their role in verifying the legitimacy of an email CEO or CFO or politicians and celebrities to steal address is discussed. Moreover, use of techniques such as sensitive information. readability metrics and text mining methods such as frequent • Pharming (Phishing without a lure): Mostly using pattern detection, association rules and document similarity DNS Cache poisoning and Host File Modification, the for phish detection are explained. Lastly, a few binary email attacker executes malware on a target machine to classifiers are trained and tested and their results are automatically redirect victim’s traffic to a website interpreted. controlled by the attacker. • SPIM (Spam over instant messaging): Spimmers Keywords: Email Forensics Analysis, Phish Email Detection, Text exploit instant messaging platforms as a tool to spread Mining, Readability Tests. spam which generally include embedded hyperlinks or malware to gather personal information. 1. INTRODUCTION Simplicity, speed and a relatively high degree of anonymity In