A Design of an Anti-Phishing Training System Collaborated with Multiple Organizations

Phishing is a dangerous threat to organizations. A sender of a phishing email pretends to be a trusted person to steal valuable information, including personal identity data and credentials. If a targeted organization is sent a large number of attack emails, many members will be stolen valuable information. As a result, there are cases where the damage spreads by attack techniques in which targeted attack emails are sent in chaining from the account to other organizations. It is difficult to defend from such an attack by a single organization alone. In this paper, we design a system that can share information about phishing attack emails quickly and perform an anti-phishing training between multiple organizations. This system semi-automatically detoxifies and anonymizes attack emails received by an organization and shares it with multiple organizations. Each organization becomes possible to perform semiautomatic and continuous anti-phishing training using current attacking information.