Abstract

A spear phishing attack is an advanced type of phishing attack. These attacks utilize deception through personalized messages that target both individuals and organizations. Although they are not technically considered phishing, they utilize social engineering techniques to trick users into performing jobs. This paper proposes a way to detect spear phishing attacks by applying rules based on the combination of technical indicators and user behavior. The system evaluates several metrics including content pattern matching, authentication of the sender, and risk rating the content. The experimental results provide evidence that the proposed lightweight phishing detection framework improves detection performance from 85 percent to 90 percent when using social engineering indicators and technical analysis to highlight patterns in behavior. In addition, the proposed model requires very little computing power and can be deployed and effectively used in real time in an enterprise environment with far less reliance on large training datasets compared to machine-learning-based methods.