Scholarlink

<p>Phishing attacks remain a persistent threat in cybersecurity. Attackers continuously create deceptive webpages to trick users. As a result, the cybersecurity research community needs to build detection systems that can keep pace. Many existing methods rely on fixed-length padding to handle variable-length URLs, resulting in sparse inputs and reduced classifier performance in unknown data. We propose an augmentation framework that improves phishing detection by completing short or partial URLs before classification. We split each URL into a prefix and a target, train a character-level generator to produce realistic completions conditioned on the prefix, and add these completions to the training set alongside the original URLs. Then, a page-level classifier takes the main URL and all embedded URLs within a webpage as input. It predicts whether the page is phishing or benign. We evaluate the framework on a dataset of 31,462 webpages collected from Alexa and PhishTank. Across five random seeds, the Full Model achieves a mean AUC of 0.9425 (0.0029), compared with 0.9381 (0.0024) for the baseline, and improves recall from 0.8732 to 0.8857. A paired t-test confirms the gains are statistically significant (<InlineEquation ID="IEq1"><EquationSource Format="TEX">\(t = 4.49\)</EquationSource></InlineEquation>, <InlineEquation ID="IEq2"><EquationSource Format="TEX">\(p = 0.0109\)</EquationSource></InlineEquation>). A control experiment with random valid suffixes confirms that the learned generator contributes beyond simply adding character mass; random suffixes hurt recall, while the learned generator substantially improves it. The method reduces target tensor sparsity by 32.90 % points for short URLs. It maintains strong performance even when 50% of embedded URLs are missing during inference. These results show that prefix-conditioned URL completion provides a practical and effective augmentation strategy for phishing detection, improving recall while keeping false positives low.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Phishing webpage detection using structured URL generation

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月27日

查看全文
  • Sultan Asiri,
  • Naif Alasmari

摘要

Phishing attacks remain a persistent threat in cybersecurity. Attackers continuously create deceptive webpages to trick users. As a result, the cybersecurity research community needs to build detection systems that can keep pace. Many existing methods rely on fixed-length padding to handle variable-length URLs, resulting in sparse inputs and reduced classifier performance in unknown data. We propose an augmentation framework that improves phishing detection by completing short or partial URLs before classification. We split each URL into a prefix and a target, train a character-level generator to produce realistic completions conditioned on the prefix, and add these completions to the training set alongside the original URLs. Then, a page-level classifier takes the main URL and all embedded URLs within a webpage as input. It predicts whether the page is phishing or benign. We evaluate the framework on a dataset of 31,462 webpages collected from Alexa and PhishTank. Across five random seeds, the Full Model achieves a mean AUC of 0.9425 (0.0029), compared with 0.9381 (0.0024) for the baseline, and improves recall from 0.8732 to 0.8857. A paired t-test confirms the gains are statistically significant (\(t = 4.49\), \(p = 0.0109\)). A control experiment with random valid suffixes confirms that the learned generator contributes beyond simply adding character mass; random suffixes hurt recall, while the learned generator substantially improves it. The method reduces target tensor sparsity by 32.90 % points for short URLs. It maintains strong performance even when 50% of embedded URLs are missing during inference. These results show that prefix-conditioned URL completion provides a practical and effective augmentation strategy for phishing detection, improving recall while keeping false positives low.