## 4 Validation of the Proposed E-mail-based Phishing Attack Taxonomy
### Phishing Attack Notating by Using Proposed E-mail-based Phishing Attack Taxonomy  
To evaluate the practical application of the proposed e-mail-based phishing attack taxonomy, we compared how detailed phishing attack notations were before the taxonomy and how the phishing attack descriptions changed after adapting the proposed taxonomy. Vilnius Gediminas Technical University has an Information Technology Management Department (ITMD). One of the responsibilities of this department is to investigate cyber-attacks against VGTU and its employees. Information about e-mail-based phishing attacks is gathered from the e-mail system (filtering out undesired e-mails) and emails received from employees in the HelpDesk system. Each incident is categorized and detailed, notated by systemically presenting the known information about the attack. E-mail-based phishing attacks are notated manually by the employees of ITMD. Several persons do the notation, as there are several phases (initial notation, detail confirmation, modification after incident investigation) with different notators and multiple persons can be used in each of the phases. After proposing the e-mail-based phishing attack taxonomy, a form to notate e-mail-based phishing attacks (see Figure 5) is presented and used as a template for incident notating. Figure 5: Form for e-mail-based phishing attack notating. For comparison purposes, to define how the usage of the proposed e-mail-based phishing attack taxonomy changes the notation of phishing attacks, we took the last 50 phishing attacks, which were notated in a free form and asked to do the notation once again but by using the provided notation form (based on the proposed taxonomy). The attacks were the same, and the persons who notated them were the same (the same employees were used in this process, but a specific incident can be notated by different persons). Therefore, we were able to compare how the notations differed depending on the notation form. Among those 50 phishing attack e-mails, all of them were collected by ITMD (registered by VGTU employees or obtained from system monitoring logs). About 74% of them were written in English, while 26% were written in (or translated into) Lithuanian. It is worth mentioning that one e-mail was generated by VGTU itself, as a testing tool to evaluate employees' credulity to phishing attacks [23]. The benefit of used taxonomy for phishing e-mail notation can be evaluated by several criteria:  
1. Unambiguity of assigned description--whether the description is understandable and needs additional explanation to another person or even machine to understand the description. The unambiguity can be evaluated by measuring whether the description is clear or uses blurry expressions. 2. The detail level in the description--whether the description reflects all properties of the phishing attack and there is no need to analyze the e-mail again. The detail level can be evaluated by measuring how many different properties or categories are assigned to the phishing attack. In our experiment, the first evaluation criterion (unambiguity) is clearly expressed as free form notating and has no dictionary or clear requirements, while taxonomy-based phishing e-mail notation allows selection of possible properties from a discrete list. As the free form description is not standardized, sometimes the same person notates two identical phishing e-mail by using different text (\"won a lottery\" and \"fake information about possible profit\"). With taxonomy-based notation, the same keywords are selected, and the variety of similar e-mails are noted by missing some values because of the inability to identify them.