A dual-layer deep learning model for parallel analysis of URL and HTML features in phishing website detection
摘要
Phishing pages are a main vector for the distribution of malicious content and the spread of online fraud, and need to be timely and accurately detected. Current detection methods mainly use manually engineered lexical and statistical features extracted from website content, incurring high computation cost and requiring domain knowledge, but cannot fully capture the complex semantic information embedded in Uniform Resource Locator (URL) structures and HyperText Markup Language (HTML) content. In this paper, we propose a novel raw URL and HTML features-based multi-modal phishing detection model with a dual-branch Convolutional Neural Networks (CNN) architecture, which is able to learn features representations from each data modality prior to combining them. The experimental study shows that with 99.53% classification accuracy, the proposed CNN-based model substantially outperforms the two baseline methods. The multi-modal approach makes the detection more robust by examining URL syntactic patterns and HTML semantic content together which helps to resist various phishing attack vectors. The findings show that the CNN-based networks are efficient in detecting phishing and the concatenated processing of URL and HTML features is effective, benefiting the detection results over single-modality methods.