Research on phishing webpage detection technology based on CNN-BiLSTM algorithm

Abstract

The rapid development of the Internet has also brought opportunities for some illegal elements. Network attackers steal sensitive information from victims through phishing webpages to obtain economic benefits. Currently, the commonly used detection methods for phishing webpages, based on blacklist detection and webpage content feature detection, have the problems of being unable to detect newly emerging phishing webpages or requiring manual extraction of webpage features. Therefore, researchers have used Convolution Neural Network (CNN) to detect phishing webpages by automatically extracting URL features. However, its method has some limitations: (1) The memory is limited when the URL is transformed into the feature matrix, and the embedding vector of new words cannot be obtained or the effective information of sensitive words is lost; (2) the long-distance dependent feature of the URL cannot be obtained. In response to the above challenges, we proposes a phishing detection method based on CNN and Bi-directional Long Short-Term Memory (Bi-LSTM) based on existing work: based on sensitive word segmentation-- comprehensively using two existing URL segmentation methods before converting URL into eigenvector matrix; adding Bi-LSTM on the basis of convolutional neural network to obtain URL long-distance dependent features. Experimental results show that this method can achieve high accuracy, recall rate and F1 value.

A hybrid DNN–LSTM model for detecting phishing URLs

“…In hybrid models combining two different feature sets, a CNN-based model can be used instead of the RNN-based model used for character embedding features. However, a CNN-based model has high memory requirements and could not expose long-distance dependent features [ 74 ].…”

“…Using character embedding with CNN-based models had the following limitations: (1) CNN-based models had high memory needs (2) CNN-based models could not find long-distance dependent features. Novel hybrid architecture that uses RNN-based models instead of CNN-based models can cope with this challenge [ 74 ].…”

Phishing Webpage Classification via Deep Learning-Based Algorithms: An Empirical Study

“…Similarly, the authors of [24,28,29,32] described the optimization process, but only on certain parameters, for example, the number of convolutional layers, number of kernels, and kernel size. Additionally, in terms of performance metrics, it was observed that accuracy, precision, recall, and F1-score were the most common measures [7,24,28,[30][31][32]34,35,37,38]. Other evaluation metrics were training time, detection time, GPU memory requirement, etc.…”

Phishing URL Detection Using CNN-LSTM and Random Forest Classifier

“…The third way that has proven to be the most effective is to use machine learning and deep learning techniques that learns about the characteristic features of previous malicious links and can make accurate distinctions in the future based on previous predictions made [2]. Current mainstream machine learning methods of phishing website detection extract statistical features from the URL or extract relevant features of the webpage, such as the layout, Domain information or HTML& JavaScript and then classify these features but machine learning algorithms do not analyze the sequence or the positions of words in a URL and also 63% of phishing websites have a lifespan of only 2 hours after which they change either expire or change their domain name [3]. In order to use the machine learning techniques that focuses on the statistical features of URL and also to exploit the orientation and sequence learning capability of deep learning, we propose a CNN-LSTM model along with Random Forest, they belong to the eld of deep learning whereas Random Forest classi er belongs to the eld of machine learning.…”

“…Their method rst performed word segmentation processing on URL based on sensitive word segmentation, then converted it into a feature vector matrix that automatically extracts its local features through CNN and acquired its bidirectional long-distance dependent features through BiLSTM. Their model classi ed the phishing and legitimate URLs with accuracy of 98.84% [3].…”