# SOK: A Comprehensive Reexamination of Phishing Research from the Security Perspective

arXiv: https://arxiv.org/abs/1911.00953 · HTML: https://mlsanity.com/paper/1911.00953/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Nov 2019.

## Built on by (most cited first, 15 of 15)

- [SoK: The Impact of Unlabelled Data in Cyberthreat Detection](https://mlsanity.com/paper/2205.08944/) (2022)
- [Lateral Phishing With Large Language Models: A Large Organization Comparative Study](https://mlsanity.com/paper/2401.09727/) (2024)
- [XAI for Cybersecurity: State of the Art, Challenges, Open Issues and Future Directions](https://mlsanity.com/paper/2206.03585/) (2022)
- [RAIDER: Reinforcement-aided Spear Phishing Detector](https://mlsanity.com/paper/2105.07582/) (2021)
- [Prompted Contextual Vectors for Spear-Phishing Detection](https://mlsanity.com/paper/2402.08309/) (2024)
- [Domain-Independent Deception: A New Taxonomy and Linguistic Analysis](https://mlsanity.com/paper/2402.01019/) (2024)
- [PhreshPhish: A Real-World, High-Quality, Large-Scale Phishing Website Dataset and Benchmark](https://mlsanity.com/paper/2507.10854/) (2025)
- [Comparative Analysis of Black-Box and White-Box Machine Learning Model in Phishing Detection](https://mlsanity.com/paper/2412.02084/) (2024)
- [Web Phishing Net (WPN): A scalable machine learning approach for real-time phishing campaign detection](https://mlsanity.com/paper/2502.13171/) (2025)
- [Finding Phish in a Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs](https://mlsanity.com/paper/2106.12343/) (2021)
- [Man versus Machine: AutoML and Human Experts' Role in Phishing Detection](https://mlsanity.com/paper/2108.12193/) (2021)
- [Classification of Web Phishing Kits for early detection by platform providers](https://mlsanity.com/paper/2210.08273/) (2022)
- [Phishing Email Detection Using Large Language Models](https://mlsanity.com/paper/2512.10104/) (2025)
- [Robustness, Cost, and Attack-Surface Concentration in Phishing Detection](https://mlsanity.com/paper/2603.19204/) (2026)
- [CoGReV: A Confidence-Gated Post-Hoc Non-Monotonic Belief Revision Framework for Phishing Website Classification](https://mlsanity.com/paper/2604.25512/) (2026)

## Abstract (arXiv)

Phishing and spear-phishing are typical examples of masquerade attacks since trust is built up through impersonation for the attack to succeed. Given the prevalence of these attacks, considerable research has been conducted on these problems along multiple dimensions. We reexamine the existing research on phishing and spear-phishing from the perspective of the unique needs of the security domain, which we call security challenges: real-time detection, active attacker, dataset quality and base-rate fallacy. We explain these challenges and then survey the existing phishing/spear phishing solutions in their light. This viewpoint consolidates the literature and illuminates several opportunities for improving existing solutions. We organize the existing literature based on detection techniques for different attack vectors (e.g., URLs, websites, emails) along with studies on user awareness. For detection techniques, we examine properties of the dataset, feature extraction, detection algorithms used, and performance evaluation metrics. This work can help guide the development of more effective defenses for phishing, spear-phishing, and email masquerade attacks of the future, as well as provide a framework for a thorough evaluation and comparison.