SpacePhish: The Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning

Abstract

Existing literature on adversarial Machine Learning (ML) focuses either on showing attacks that break every ML model, or defenses that withstand most attacks. Unfortunately, little consideration is given to the actual cost of the attack or the defense. Moreover, adversarial samples are often crafted in the "feature-space", making the corresponding evaluations of questionable value. Simply put, the current situation does not allow to estimate the actual threat posed by adversarial attacks, leading to a lack of secure ML systems.We aim to clarify such confusion in this paper. By considering the application of ML for Phishing Website Detection (PWD), we formalize the "evasion-space" in which an adversarial perturbation can be introduced to fool a ML-PWD-demonstrating that even perturbations in the "feature-space" are useful. Then, we propose a realistic threat model describing evasion attacks against ML-PWD that are cheap to stage, and hence intrinsically more attractive for real phishers. Finally, we perform the first statistically validated assessment of state-of-the-art ML-PWD against 12 evasion attacks. Our evaluation shows (i) the true efficacy of evasion attempts that are more likely to occur; and (ii) the impact of perturbations crafted in different evasion-spaces. Our realistic evasion attempts induce a statistically significant degradation (3-10% at 𝑝 <0.05), and their cheap cost makes them a subtle threat. Notably, however, some ML-PWD are immune to our most realistic attacks (𝑝=0.22). Our contribution paves the way for a much needed re-assessment of adversarial attacks against ML systems for cybersecurity.

"Are Adversarial Phishing Webpages a Threat in Reality?" Understanding the Users' Perception of Adversarial Webpages

“…Then we add perturbations to a phishing webpage, aiming to trigger a false negative by the ML-PWD. In more detail, our ML-PWD relies on the random forest algorithm (thanks to its superior performance over other ML algorithms, as reported by many prior works [10,76]). 2 In particular, we rely on the code (and features 3 ) provided by [10] to develop our ML-PWD, for which we use 80% of the dataset for training and use the remaining 20% for testing.…”

“…In more detail, our ML-PWD relies on the random forest algorithm (thanks to its superior performance over other ML algorithms, as reported by many prior works [10,76]). 2 In particular, we rely on the code (and features 3 ) provided by [10] to develop our ML-PWD, for which we use 80% of the dataset for training and use the remaining 20% for testing. Our ML-PWD obtains performance comparable with the state-of-the-art, having a true positive rate of 0.98 and a false positive rate of 0.04 (results aligning with prior works [10,66]).…”

“…Given the above, all those papers (e.g., [10,11,24,49,57]) showing that ML-PWD can be evaded via "adversarial perturbations" -while useful for investigating some robustness properties of ML -could hardly provide a compelling case that "adversarial examples are a problem in reality". Indeed, doing so would necessitate a double form of assessment, entailing both machine and human: first, it is necessary to craft an adversarial webpage and show that it bypasses a functional ML-PWD (i.e., a false negative); then, it is necessary to assess whether humans (i.e., the true target of phishing) are still tricked by such a webpage.…”

“…2 In particular, we rely on the code (and features 3 ) provided by [10] to develop our ML-PWD, for which we use 80% of the dataset for training and use the remaining 20% for testing. Our ML-PWD obtains performance comparable with the state-of-the-art, having a true positive rate of 0.98 and a false positive rate of 0.04 (results aligning with prior works [10,66]). These results confirm that our ML-PWD (which we release [5]) is a valid candidate for our research.…”

“…We adapt existing AML methods [10,84] to generate adversarial phishing webpages "in a lab" (𝐴𝑃𝑊 -𝐿𝑎𝑏). More specifically, we selected four types of perturbations 4 that should evade our custom ML-PWD, each yielding an adversarial phishing webpage having diverse visual cues:…”