Identification of phishing websites through hyperlink analysis and rule extraction

Abstract

Purpose The aim of this study is to propose an efficient rule extraction and integration approach for identifying phishing websites. The proposed approach can elucidate patterns of phishing websites and identify them accurately. Design/methodology/approach Hyperlink indicators along with URL-based features are used to build the identification model. In the proposed approach, very simple rules are first extracted based on individual features to provide meaningful and easy-to-understand rules. Then, the F-measure score is used to select high-quality rules for identifying phishing websites. To construct a reliable and promising phishing website identification model, the selected rules are integrated using a simple neural network model. Findings Experiments conducted using self-collected and benchmark data sets show that the proposed approach outperforms 16 commonly used classifiers (including seven non–rule-based and four rule-based classifiers as well as five deep learning models) in terms of interpretability and identification performance. Originality/value Investigating patterns of phishing websites based on hyperlink indicators using the efficient rule-based approach is innovative. It is not only helpful for identifying phishing websites, but also beneficial for extracting simple and understandable rules.

A Systematic Review: Detecting Phishing Websites Using Data Mining Models

“…After reviewing 33 papers concerned with phishing, DM, and ML techniques from 2018 to 2021, it was demonstrated that much effort has been put together to find and create models that can detect and differentiate between phishing and legitimate websites. Some studies focused on detecting phishing websites by finding relationships between the URL characters [25] , while others used URL features [22,25,28] . References [21,26] used a different technique to analyze hyperlinks through integration rules from which suspicious ones can detected.…”

“…The researchers proposed an integrated model that features combinations of images, text, and frames in the detection process. The results show that different algorithms were used, and multiple models were created by combining two to four techniques to get better results [24,25,27,[29][30][31][32] . Other studies used multiple models and compared their results to find the best approach [6,11,28,34] .…”

“…The authors of Refs. [3,25,28,29,33] followed this approach for detecting phishing. It was observed that the researchers of Refs.…”

“…Reference [25] mentioned that setting up a blacklist for phishing websites and URLs is inefficient as new websites are being developed daily. To find a solution for detecting phishing URLs, they proposed a model that can find the relationship between URL characters, resulting in more accurate detection of phishing URLs.…”

A Hybrid Phishing Detection System Using Deep Learning-based URL and Content Analysis

“…In another paper, URLs and hyperlinks are passed through certain rules and features are obtained [20]. An accuracy of 99.80 % was obtained as a result of the artificial neural network used in the dataset created with 1,000 legitimate URLs from Alexa database and 1,000 phishing URLs from the PhishTank website.…”