Brief Description
Analyze a dataset of phishing website reports (from phishing-reporting services), to identify common technical, linguistic, visual, and structural features.
Research Questions
What are the most frequent features of phishing websites (URL length, use of HTTPS, domain age, registration country, visual mimicry etc.)?
How have features evolved over time (e.g. more use of HTTPS, more credible visual designs)?
Can a lightweight classifier be built that distinguishes phishing vs legit sites based on these features with acceptable accuracy?
Methodology
Acquire datasets: e.g. PhishTank, OpenPhish, or other publicly reported phishing site databases.
For each site, scrape/collect metadata: domain age, SSL presence, URL characteristics, keywords, presence of forms etc.
Possibly also use archived screenshots or HTML to analyze visual or linguistic features.
Use descriptive statistics to find common patterns.
Build a classifier (machine learning: e.g. decision tree, random forest, logistic regression) using features extracted. Evaluate with cross-validation.
Analysis of trends over years if data spans time.