Deep Learning for Phishing Detection: Taxonomy, Current Challenges and Future Directions

Abstract

Phishing has become an increasing concern and captured the attention of end-users as well as security experts. Despite decades of development and improvement, existing phishing detection techniques still suffer from the deficiency in performance accuracy and the inability to detect unknown attacks. Motivated to solve these problems, many researchers in the cybersecurity domain have shifted their attention to phishing detection that capitalizes on machine learning techniques. In recent years, deep learning has emerged as a branch of machine learning that has become a promising solution for phishing detection. As a result, this study proposes a taxonomy of deep learning algorithms for phishing detection by examining 81 selected papers using a systematic literature review approach. The paper first introduces the concept of phishing and deep learning in the context of cybersecurity. Then, phishing detection and deep learning algorithm taxonomies are provided to classify the existing literature into various categories. Next, taking the proposed taxonomy as a baseline, this study comprehensively reviews the state-of-the-art deep learning techniques and analyzes their advantages as well as disadvantages. Subsequently, the paper discusses various issues deep learning faces in phishing detection and proposes future research directions to overcome these challenges. Finally, an empirical analysis is conducted to evaluate the performance of various deep learning techniques in a practical context and highlight the related issues that motivate researchers in their future works. The results obtained from the empirical experiment showed that the common issues among most of the state-of-the-art deep learning algorithms are manual parameter-tuning, long training time, and deficient detection accuracy.

Sufficiency of Ensemble Machine Learning Methods for Phishing Websites Detection

“…Both of the feature selection frameworks above can provide a fully automatic, flexible, and robust system to produce high-quality subfeature sets. Furthermore, the framework can be applied to various datasets, which can provide a solution to the problem discussed in [4] that manual feature engineering is separated from classification tasks in conventional ML models.…”

“…In a recent comprehensive DL-based review in the phishing detection field [4], N. Q. Do et al indicated that Each DL algorithm has unique properties that make it ideal for a specific application.…”

“…University California Irvine Machine Learning Repository (UCI) is a common repository that contains both fraudulent and trustworthy website URLs, which is popular among phishing detection researchers [37] [38] [4]. The dataset was donated in 2015 and collected primarily from PhishTank and MillerSmiles archives.…”

“…Parameters can differ between different DL models, such as the number of layers in the model, batch size, the number of epochs, type of optimizer, type of activation function in hidden layers and output layer, etc. [4]. Based on these steps, we built a 3-layers LSTM model with one dropout layer and one dense layer.…”

“…Existing phishing detection methods usually choose ML or DL to detect unknown attacks. Due to its ability to automatically extract features, DL has recently been seen as a promising phishing detection tool [4]. However, our research found that based on some generally recognized phishing websites features [5], conventional ML methods achieve higher accuracy and lower false-positive rate.…”