# Towards a Hybrid Security Framework for Phishing Awareness Education and Defense
## 2 Related or Existing Work  
In advanced phishing, AI can be and is already being used by attackers to automate or semi-automate their attacks and significantly reduce the amount of effort needed to carry them out. Attackers can increase their return by scaling up the effectiveness and volume of attacks by spending less time developing successful techniques. Phishing attacks enabled by AI can mimic trusted user behavior, make calls for the attacker with voice impersonation, and so on [5; 6]. A range of research works on AI-based phishing exists. Few of these focus on using AI to detect phishing attacks [3; 7; 9] while others detail how sophisticated phishing attacks can be developed with AI assistance [10; 11; 12]. We review and critique both categories. Ref. [9] provides a critical survey and review of research works from natural language processing (NLP) and machine learning (ML) communities to build accurate detectors for English. An in-depth error analysis of the state-of-the-art detector was also conducted and research directions to guide future research in the detection of disinformation. Ref. [7] presents an AI as a service (AIaas)--based defense framework to detect phishing attacks. OpenAI's GPT-3 API was used to accurately distinguish between machine- and human-generated text. The results demonstrate that there is potential to design a credible defense framework against advanced AI text generators without requiring significant AI expertise or resources. However, the results will need to be validated by a much larger-scale study encompassing multiple contexts and models. Ref. [3] provides a literature review of AI techniques: Machine Learning, Deep Learning, Hybrid Learning, and Scenario-based techniques for phishing attack detection. The paper also provides a comparison of different studies detecting phishing attacks for each AI technique and examines the benefits and limitations of these methodologies. Ref. [10] presents a long short-term memory (LSTM) neural network that learns to socially engineer specific users into clicking on deceptive URLs. The model is trained with word vector representations of social media posts. It is also dynamically seeded with topics extracted from the target's timeline in order to make a click-through more likely. Users are also triaged to determine which ones are more likely to be phished and vulnerable users are sent highly personalized messages. Research has since progressed with the use of tools like Chat-GPT, which obviates the need to first segregate vulnerable targets before launching the phishing attack. Ref. [11] explores the possibility of using Chat-GPT to develop advanced phishing attacks and automate their large-scale deployment. Their threat model involves a sophisticated and fully automated phishing kit. A user (attacker) needs to have a programming foundation, e.g., in Python and knowledge of OpenAI Codex models and Github Copilot. The Codex model integrates with Copilot which, in turn, is integrated with Integrated Development Environments (IDEs). Attack test cases center on the cloning of websites to create phishing duplicates. Ref. [12] explores the different applications of generative AI in social engineering attacks. Using the blog mining technique, some insights into the evolving threat landscape are proposed. The rise in generative AI models, like ChatGPT, FraudGPT, and WormGPT, has augmented existing threats and ushered in new dimensions of risk. These range from phishing campaigns that mimic trusted organizations to deepfake technology impersonating authoritative figures. Ref. [4] provides an overview of how the application of artificial intelligence to phishing significantly impacts the healthcare industry and concludes with efforts that should be made to reduce the success rate of all phishing attacks, including those that have been augmented by the use of AI. The paper emphasizes that awareness training for end users is imperative. It advises that users should be trained to detect phishing e-mails and to manage all e-mails with vigilance.