The persistent growth in phishing and the rising volume of phishing websites has led to individuals and organizations worldwide becoming increasingly exposed to various cyber-attacks. Consequently, more effective phishing detection is required for improved cyber defence. Hence, in this paper we present a deep learning-based approach to enable high accuracy detection of phishing sites. The proposed approach utilizes convolutional neural networks (CNN) for high accuracy classification to distinguish genuine sites from phishing sites. We evaluate the models using a dataset obtained from 6,157 genuine and 4,898 phishing websites. Based on the results of extensive experiments, our CNN based models proved to be highly effective in detecting unknown phishing sites. Furthermore, the CNN based approach performed better than traditional machine learning classifiers evaluated on the same dataset, reaching 98.2% phishing detection rate with an F1-score of 0.976. The method presented in this paper compares favourably to the state-of-the art in deep learning based phishing website detection.
PhishGuard: A Convolutional Neural Network Based Model for Detecting Phishing URLs with Explainability Analysis
Uttara University（乌拉拉大学）；University of Oslo（奥斯陆大学）；Khulna University of Engineering and Technology (KUET)（库尔纳工程技术大学）；BRAC University（BRAC大学）；North South University（北南大学）；American International University Bangladesh (AIUB)（孟加拉国美国国际大学）
CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Phishing websites are still a major threat in today's Internet ecosystem. Despite numerous previous efforts, similarity-based detection methods do not offer sufficient protection for the trusted websites - in particular against unseen phishing pages. This paper contributes VisualPhishNet, a new similarity-based phishing detection framework, based on a triplet Convolutional Neural Network (CNN). VisualPhishNet learns profiles for websites in order to detect phishing websites by a similarity metric that can generalize to pages with new visual appearances. We furthermore present VisualPhish, the …
Phishing attacks are among emerging security issues that recently draws significant attention in the cyber security community. There are numerous existing approaches for phishing URL detection. However, malicious URL detection is still a research hotspot because attackers can bypass newly introduced detection mechanisms by changing their tactics. This paper will introduce a transformer-based malicious URL detection model, which has significant accuracy and outperforms current detection methods. We conduct experiments and compare them with six existing classical detection models. Experiments de…
Web phishing remains a serious cyber threat responsible for most data breaches. Machine Learning (ML)-based anti-phishing detectors are seen as an effective countermeasure, and are increasingly adopted by web-browsers and software products. However, with an average of 10K phishing links reported per hour to platforms such as PhishTank and VirusTotal (VT), the deficiencies of such ML-based solutions are laid bare. We first explore how phishing sites bypass ML-based detection with a deep dive into 13K phishing pages targeting major brands such as Facebook. Results show successful evasion is caus…
The problem of detecting phishing emails through machine learning techniques has been discussed extensively in the literature. Conventional and state-of-the-art machine learning algorithms have demonstrated the possibility of building classifiers with high accuracy. The existing research studies treat phishing and genuine emails through general indicators and thus it is not exactly clear what phishing features are contributing to variations of the classifiers. In this paper, we crafted a set of phishing and legitimate emails with similar indicators in order to investigate whether these cues ar…
University of Tokyo（东京大学）；United Nations University（联合国大学）
With increasingly more sophisticated phishing campaigns in recent years, phishing emails lure people using more legitimate-looking personal contexts. To tackle this problem, instead of traditional heuristics-based algorithms, more adaptive detection systems such as natural language processing (NLP)-powered approaches are essential to understanding phishing text representations. Nevertheless, concerns surrounding the collection of phishing data that might cover confidential information hinder the effectiveness of model learning. We propose a decentralized phishing email detection framework call…
The hypothesis here states that neural network algorithms such as Multi-layer Perceptron (MLP) have higher accuracy in differentiating malicious and semi-structured phishing URLs. Compared to classical machine learning algorithms such as Logistic Regression and Multinomial Naive Bayes, the classical algorithms rely heavily on substantial corpus data training and machine learning experts' domain knowledge to perform complex feature engineering. MLP could perform non-linear separable multi-classes classification and focus less on corpus feature training. In addition, backpropagation weight adjus…
Phishing attacks are one of the trending cyber attacks that apply socially engineered messages that are communicated to people from professional hackers aiming at fooling users to reveal their sensitive information, the most popular communication channel to those messages is through users emails. This paper presents an intelligent classification model for detecting phishing emails using knowledge discovery, data mining and text processing techniques. This paper introduces the concept of phishing terms weighting which evaluates the weight of phishing terms in each email. The pre processing phas…
Recently, the development and implementation of phishing attacks require little technical skills and costs. This uprising has led to an ever-growing number of phishing attacks on the World Wide Web. Consequently, proactive techniques to fight phishing attacks have become extremely necessary. In this paper, we propose HTMLPhish, a deep learning based data-driven end-to-end automatic phishing web page classification approach. Specifically, HTMLPhish receives the content of the HTML document of a web page and employs Convolutional Neural Networks (CNNs) to learn the semantic dependencies in the t…
Data61, CSIRO（澳大利亚联邦科学与工业研究组织Data61）；Cyber Security Cooperative Research Centre（网络安全合作研究中心）
The use of Artificial Intelligence (AI) to detect phishing emails is primarily dependent on large-scale centralized datasets, which opens it up to a myriad of privacy, trust, and legal issues. Moreover, organizations are loathed to share emails, given the risk of leakage of commercially sensitive information. So, it is uncommon to obtain sufficient emails to train a global AI model efficiently. Accordingly, privacy-preserving distributed and collaborative machine learning, particularly Federated Learning (FL), is a desideratum. Already prevalent in the healthcare sector, questions remain regar…
The University of Sheffield（谢菲尔德大学）；Liverpool John Moores University（利物浦约翰摩尔大学）
Phishing attacks are the most common type of cyber-attacks used to obtain sensitive information and have been affecting individuals as well as organisations across the globe. Various techniques have been proposed to identify the phishing attacks specifically, deployment of machine intelligence in recent years. However, the deployed algorithms and discriminating factors are very diverse in existing works. In this study, we present a comprehensive analysis of various machine learning algorithms to evaluate their performances over multiple datasets. We further investigate the most significant fea…
University of North Dakota（北达科他大学）；University of North Carolina at Charlotte（北卡罗来纳大学夏洛特分校）
Phishing attacks are one of the most common social engineering attacks targeting users emails to fraudulently steal confidential and sensitive information. They can be used as a part of more massive attacks launched to gain a foothold in corporate or government networks. Over the last decade, a number of anti-phishing techniques have been proposed to detect and mitigate these attacks. However, they are still inefficient and inaccurate. Thus, there is a great need for efficient and accurate detection techniques to cope with these attacks. In this paper, we proposed a phishing attack detection t…
College of Information Engineering, Zhejiang University of Technology（浙江工业大学信息工程学院）；Institute of Cyberspace Security, Zhejiang University of Technology（浙江工业大学网络空间安全研究院）；PCL Research Center of Networks and Communications, Peng Cheng Laboratory（鹏城实验室PCL网络与通信研究中心）
Blockchain technology and, in particular, blockchain-based transaction offers us information that has never been seen before in the financial world. In contrast to fiat currencies, transactions through virtual currencies like Bitcoin are completely public. And these transactions of cryptocurrencies are permanently recorded on Blockchain and are available at any time. Therefore, this allows us to build transaction networks (TN) to analyze illegal phenomenons such as phishing scams in blockchain from a network perspective. In this paper, we propose a Transaction SubGraph Network (TSGN) based cla…
PhishVQC: Optimizing Phishing URL Detection with Correlation Based Feature Selection and Variational Quantum Classifier
Dept. of Computer Science and Engineering（计算机科学与工程系）；World University of Bangladesh（世界大学）；Southern University Bangladesh（孟加拉国南方大学）；Brac University（布拉大学）
University of New South Wales（新南威尔士大学）；Data61, CSIRO（澳大利亚联邦科学与工业研究组织 Data61）；Cyber Security Cooperative Research Centre（网络安全合作研究中心）
Phishing has grown significantly in the past few years and is predicted to further increase in the future. The dynamics of phishing introduce challenges in implementing a robust phishing detection system and selecting features which can represent phishing despite the change of attack. In this paper, we propose PhishZip which is a novel phishing detection approach using a compression algorithm to perform website classification and demonstrate a systematic way to construct the word dictionaries for the compression models using word occurrence likelihood analysis. PhishZip outperforms the use of …
AntiPhishStack: LSTM-based Stacked Generalization Model for Optimized Phishing URL Detection
Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences（中国科学院深圳先进技术研究院）；Shenzhen College of Advanced Technology, University of Chinese Academy of Sciences（中国科学院大学深圳先进技术学院）；University of Genoa（热那亚大学）；University of Catania（卡塔尼亚大学）；Shenzhen Polytechnic University（深圳职业技术大学）
A Lightweight Hybrid MLP-Based Framework for Real-Time Phishing URL Detection Using Structural URL Features
Department of Cyber Security Science, School of Information and Communication Technology, Federal University of Technology, Minna, Nigeria（网络安全科学系，信息与通信技术学院，联邦科技大学，米纳，尼日利亚）
PhishSnap: Image-Based Phishing Detection Using Perceptual Hashing
Dept. of CSE United International University Dhaka, Bangladesh（计算机科学与工程系，国际联合大学，达卡，孟加拉国）；Professor, Dept. of CSE United International University Dhaka, Bangladesh（计算机科学与工程系，国际联合大学，达卡，孟加拉国）
An investigation into the performances of the Current state-of-the-art Naive Bayes, Non-Bayesian and Deep Learning Based Classifier for Phishing Detection: A Survey
The University of Texas at El Paso（德克萨斯大学埃尔帕索分校）；Office of Naval Research（海军研究办公室）；Palo Alto Networks Inc（帕洛阿尔托网络公司）
An Explainable Transformer-based Model for Phishing Email Detection: A Large Language Model Approach
Department of Computer Science and Engineering, BGC Trust University Bangladesh（Bangladesh BGC Trust 大学 计算机科学与工程系）；Department of Computer Science and Engineering, International Islamic University Chittagong（Bangladesh 国际伊斯兰大学 昌德加荣分校 计算机科学与工程系）；Centre for Securing Digital Futures, School of Science, Edith Cowan University（澳大利亚 埃德温·考文大学 科学学院 安全数字未来中心）
EvoMail: Self-Evolving Cognitive Agents for Adaptive Spam and Phishing Email Defense
People’s Liberation Army 77606 Unit（中国人民解放军77606单位）；Field Engineering College, Army Engineering University of PLA（陆军工程大学工程学院）；College Of Software, ZhengZhou University of Light Industry（郑州轻工业大学软件学院）
Phishing emails are the first step for many of today's attacks. They come with a simple hyperlink, request for action or a full replica of an existing service or website. The goal is generally to trick the user to voluntarily give away his sensitive information such as login credentials. Many approaches and applications have been proposed and developed to catch and filter phishing emails. However, the problem still lacks a complete and comprehensive solution. In this paper, we apply knowledge discovery principles from data cleansing, integration, selection, aggregation, data mining to knowledg…
PhishKey: A Novel Centroid-Based Approach for Enhanced Phishing Detection Using Adaptive HTML Component Extraction
Vicomtech Foundation, Basque Research and Technology Alliance (BRTA)（维克科技基金会、巴斯克研究与技术联盟）；Department of Electrical Engineering, Systems and Automation, Universidad de León（电气工程、系统与自动化系，莱昂大学）；Spanish National Institute of Cybersecurity (INCIBE)（西班牙网络安全国家研究所）
本文提出 PhishKey 钓鱼检测方法，结合 CNN 进行 URL 字符级分类与 CAPE 提取器处理 HTML 内容，通过软投票集成提升准确性与鲁棒性，在多个数据集上达到 98.70% F1 分数并有效抵御对抗攻击。
With increasing technology developments, there is a massive number of websites with varying purposes. But a particular type exists within this large collection, the so-called phishing sites which aim to deceive their users. The main challenge in detecting phishing websites is discovering the techniques that have been used. Where phishers are continually improving their strategies and creating web pages that can protect themselves against many forms of detection methods. Therefore, it is very necessary to develop reliable, active and contemporary methods of phishing detection to combat the adap…
