Comparative Study of Deep Learning Algorithms in the Detection of Phishing Attacks Based on HTML and Text Obtained from Web Pages

Benavides, Eduardo; Fuertes, Walter; Sánchez-Gordón, Sandra; Rodriguez, German; Martínez-Cepeda, Verónica; Nuñez-Agurto, Daniel

doi:10.1007/978-3-031-24985-3_28

Cited by 8 publications

(5 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There is also some work using a mixture of features [35][36][37][38]. These approaches may require more computational resources and be more complex to implement compared to URL-based methods.…”

Section: Methods Leveraging Multi-view Informationmentioning

confidence: 99%

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Wang

et al. 2023

Applied Sciences

View full text Add to dashboard Cite

Phishing poses a significant threat to the financial and privacy security of internet users and often serves as the starting point for cyberattacks. Many machine-learning-based methods for detecting phishing websites rely on URL analysis, offering simplicity and efficiency. However, these approaches are not always effective due to the following reasons: (1) highly concealed phishing websites may employ tactics such as masquerading URL addresses to deceive machine learning models, and (2) phishing attackers frequently change their phishing website URLs to evade detection. In this study, we propose a robust, multi-view Transformer model with an expert-mixture mechanism for accurate phishing website detection utilizing website URLs, attributes, content, and behavioral information. Specifically, we first adapted a pretrained language model for URL representation learning by applying adversarial post-training learning in order to extract semantic information from URLs. Next, we captured the attribute, content, and behavioral features of the websites and encoded them as vectors, which, alongside the URL embeddings, constitute the website’s multi-view information. Subsequently, we introduced a mixture-of-experts mechanism into the Transformer network to learn knowledge from different views and adaptively fuse information from various views. The proposed method outperforms state-of-the-art approaches in evaluations of real phishing websites, demonstrating greater performance with less label dependency. Furthermore, we show the superior robustness and enhanced adaptability of the proposed method to unseen samples and data drift in more challenging experimental settings.

show abstract

Section: Methods Leveraging Multi-view Informationmentioning

confidence: 99%

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Wang

et al. 2023

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…Past research used the text structures of websites to build frameworks for phishing detection, but phishers managed to avoid detection by including information from outside sources. Author in [21] examined the effectiveness of the long short-term memory (LSTM) classifier while investigating the field of spoofing site prediction using hyperlinks as a data source for DL models. Their study compared a new RNN-based technique with an RF classifierbased method using fourteen web address analysis criteria.…”

Section: Related Workmentioning

confidence: 99%

Enhancing Phishing Detection: A Novel Hybrid Deep Learning Framework for Cybercrime Forensics

Alsubaei,

Almazroi,

Ayub

2024

IEEE Access

View full text Add to dashboard Cite

Protecting against interference is essential at a time when wireless communications are essential for sending large amounts of data. Our research presents a novel deep learning technique, the ResNeXt method and embedded Gated Recurrent Unit (GRU) model (RNT), rigorously developed for realtime phishing attack detection. Focused on countering the escalating threat of phishing assaults and bolstering digital forensics, our systematic approach involves SMOTE for managing data imbalance during initial data processing. The model's discriminative capability is improved, particularly in the feature extraction process, when autoencoders and ResNet (EARN) are integrated with feature engineering. The ensemble technique of feature extraction reveals crucial data patterns. At the core of our AI categorization is the RNT model, optimized using hyperparameters through the Jaya optimization method (RNT-J). Rigorously tested on real phishing attack datasets, our AI model consistently outperforms state-of-the-art algorithms by a substantial margin of 11% to 19% while maintaining exceptional computing efficiency. Furthermore, our model achieves 98% accuracy, low false positive/false negative values, and a statistical execution time with a mean of 36.99s, median of 35.99s, minimum of 34.99s, maximum of 41.99s, and a standard deviation of 1.10s. Moreover, it demonstrates superior accuracy with SMOTE (98%) and without SMOTE (83%) compared to other algorithms. This state-of-the-art AI study, which focuses on digital forensics, offers enhanced security and optimized productivity for businesses and industries, signifying a breakthrough in the continuing battle against phishing attempts. Through strengthening protection against interference in wireless communication, our AI research strives to amplify data accessibility, resilience, and trustworthiness in the face of cybersecurity threats within the organizational context.

show abstract

“…[8] introduced CECOR-Net, a character-level neural network, for processing URLs and HTTP requests, which performed well on multiple datasets. [9] compared deep learning algorithms for phishing attack detection and proposed an accurate BiLSTM-based approach. These studies provide valuable insights for developing precise web attack detection algorithms.…”

Section: Related Workmentioning

confidence: 99%

A deep learning-based method for HTTP payload classification in attack detection

Zhu,

Hong,

Luo

et al. 2023

Third International Conference on Green Communication, Network, and Internet of Things (CNIoT 2023)

View full text Add to dashboard Cite

Attack detection is a crucial process that involves closely monitoring and identifying malicious attacks. To identify and locate such attacks with precision, there is a need for a thorough analysis and classification of malicious payloads. To this end, a deep learning-based method is proposed in this paper, which enables the efficient classification of payloads for attack detection. The method involves segmenting the payloads using regular expressions, which helps in preserving their syntactic structure. Also, an improved TF-IDF algorithm is introduced to construct a streamlined vocabulary that alleviates the slow training problem caused by a large vocabulary. By fusing the features of vectors extracted using CNN and BiLSTM-Attention, the payload content can be effectively represented, yielding more accurate recognition results and improving the problem of low detection accuracy associated with traditional methods. The experimental results reveal that the proposed method achieved an accuracy of 99.21% on the CSIC 2010 dataset, which is significantly higher than that of the traditional method, and has faster training speed. This suggests that the proposed method can detect more stealthy attacks and build a more effective Web attack detection system.

show abstract

Comparative Study of Deep Learning Algorithms in the Detection of Phishing Attacks Based on HTML and Text Obtained from Web Pages

Cited by 8 publications

References 12 publications

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

A Lightweight Multi-View Learning Approach for Phishing Attack Detection Using Transformer with Mixture of Experts

Enhancing Phishing Detection: A Novel Hybrid Deep Learning Framework for Cybercrime Forensics

A deep learning-based method for HTTP payload classification in attack detection

Contact Info

Product

Resources

About