KnowPhish：结合大型语言模型与多模态知识图谱以增强基于参考的钓鱼检测
KnowPhish: Large Language Models Meet Multimodal Knowledge Graphs for Enhancing Reference-Based Phishing Detection
AI总结：
针对现有基于参考的钓鱼检测器依赖人工知识库且忽略文本信息的问题，提出自动化多模态知识库KnowPhish及结合LLM的检测器KPD，能检测有无徽标的钓鱼网页，效果与效率显著提升。
摘要：
钓鱼攻击已给个人和企业造成了巨大损失，因此有必要开发稳健且高效的自动化钓鱼检测方法。基于参考的钓鱼检测器（RBPDs）通过将目标网页上的徽标与已知徽标集进行比较，已成为当前最先进的方法。然而，现有 RBPDs 的一个主要局限在于它们依赖人工构建的品牌知识库，这使其无法扩展到大量品牌，并因知识库品牌覆盖不足而导致假阴性错误。为解决此问题，我们提出了一种自动化知识收集流水线，利用它收集了一个大规模多模态品牌知识库 KnowPhish，包含 20k 个品牌及每个品牌的丰富信息。KnowPhish 能以即插即用的方式提升现有 RBPDs 的性能。现有 RBPDs 的第二个局限是它们仅依赖图像模态，忽略了网页 HTML 中存在的有用文本信息。为利用这些文本信息，我们提出了一种基于大型语言模型（LLM）的方法，从文本中提取网页的品牌信息。我们最终的多模态钓鱼检测方法 KnowPhish Detector（KPD）能够检测带有或不带徽标的钓鱼网页。我们在人工验证的数据集及新加坡本地背景下的实地研究中评估了 KnowPhish 和 KPD，结果表明，与最先进的基线方法相比，其在有效性和效率上均有显著提升。
英文摘要：
Phishing attacks have inflicted substantial losses on individuals and businesses alike, necessitating the development of robust and efficient automated phishing detection approaches. Reference-based phishing detectors (RBPDs), which compare the logos on a target webpage to a known set of logos, have emerged as the state-of-the-art approach. However, a major limitation of existing RBPDs is that they rely on a manually constructed brand knowledge base, making it infeasible to scale to a large number of brands, which results in false negative errors due to the insufficient brand coverage of the knowledge base. To address this issue, we propose an automated knowledge collection pipeline, using which we collect a large-scale multimodal brand knowledge base, KnowPhish, containing 20k brands with rich information about each brand. KnowPhish can be used to boost the performance of existing RBPDs in a plug-and-play manner. A second limitation of existing RBPDs is that they solely rely on the image modality, ignoring useful textual information present in the webpage HTML. To utilize this textual information, we propose a Large Language Model (LLM)-based approach to extract brand information of webpages from text. Our resulting multimodal phishing detection approach, KnowPhish Detector (KPD), can detect phishing webpages with or without logos. We evaluate KnowPhish and KPD on a manually validated dataset, and a field study under Singapore's local context, showing substantial improvements in effectiveness and efficiency compared to state-of-the-art baselines.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
