## 4 Validation of the Proposed E-mail-based Phishing Attack Taxonomy
### Proposed E-mail-Based Phishing Attack Taxonomy Comparison with Existing Taxonomies
Existing taxonomies do not mention phishing attacks where the attacker collects the initial data by linking the user profile and e-mail. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**C Criteria** & **Classes** & **[PERSON] et al. [13]** & **[PERSON] et al. [18]** & **[PERSON] et al.** & **[PERSON] et al.** & **[PERSON] et al. [21]** & **[PERSON] et al. [19]** \\ \hline \multirow{6}{*}{Phases of the attack} & E-mail address selection & + & & - & & & + \\  & E-mail text generation & + & & - & & & + \\  & E-mail sending & + & - & + & - & + & - \\  & E-mail sending & + & - & + & - & + & - \\  & Viking for response & - & & - & - & - & - \\  & Data gathering & + & & + & & + & \\  & Data usage & - & & - & & + & + \\ E-mail address & Existing addresses & + & - & - & - & - & - \\  & Generated addresses & + & - & - & - & - & - \\  & Benef for the user & - & & - & & & \\  & Legitimate request & + & & + & - & - & - & - \\ presentation as & Important information & - & - & - & - & - & - & - \\  & Possible failure & - & & & - & & & \\  & Other & - & & - & - & - & - & - \\  & Created & + & - & - & - & - & - & - \\  & Edined & - & - & - & - & - & - & - \\  & Duplicated & - & - & - & - & - & - & - \\  & Human & - & - & - & - & + & - & - \\  & Computer & - & - & - & - & + & - & - \\  & Not personalized & + & + & - & - & - & - \\  &  Individual & - & + & - & - & - & - \\  & Group & - & - & - & - & - & + \\  & Real & - & - & - & - & + & - \\  & Spooded & + & - & - & - & + & - \\  & Non-systemic & - & - & - & - & - & - \\  & Systematic & - & - & - & - & - & - \\  & Send multiple e-mails & & & & & & \\  & Control with other channels & & & & & & \\  & & Involve other persons & & - & - & - & - & - \\  & Other methods & & & & & & \\ Types of gathered & Profile associations & - & - & - & - & - & - & - \\  & & Scott data & + & + & + & - & - \\  & & E-mail & - & - & - & - & - \\  & Webform & + & + & + & + & + & + \\  & Other & - & + & - & - & - & + \\  & Access granting & - & - & - & - & - & - \\  & Functional fraud & - & - & - & - & - & + \\  & User/company system hacking & - & - & - & - & - & + \\  & Other & + & & & & + \\  & Criteria coverage, \% & 69 & 31 & 31 & 15 & 31 & 46 \\  & Class coverage, \% & 38 & 18 & 13 & 13 & 26 & 26 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Proposed taxonomy content comparison to other related taxonomies. The inability of the reviewed taxonomies to cover the full view of the e-mail-based phishing attack phases, classification criteria and classes are highlighted by analyzing criteria and class coverage percentages. The Phishing and Anti-Phishing taxonomy [13] covered (defined similar criteria or presented classes and mentioned cases which are part of the criteria) 69% of our proposed criteria, while all the rest of the taxonomies did not reach 50% of coverage. In regard to covered classes, the maximum coverage was 38% by the same Phishing and Anti-Phishing taxonomy [13], while the taxonomies of [PERSON] et al. [20] and [PERSON] et al. [16] covered only 13% of our detailed first-level classes (deeper classification was not analyzed).