KGhish: A Phishing Website Detection Method Based on Knowledge Graph

With the proliferation of phishing toolkits, the cost of creating phishing websites for attackers has diminished, leading to a surge in phishing attacks. Due to the similar styling of phishing websites generated by phishing toolkits, correlated features often exist among a large number of phishing sites. However, current works overlook this correlation. We employ the Knowledge Graph to provide a structured representation of these correlations and further reason and analyze them. Firstly, we extract webpage features from both phishing websites and benign websites and construct a Knowledge Graph to represent feature entities and their correlations. Subsequently, to effectively capture the structural and semantic features of nodes in the graph, at the sample level, we utilize random walks to extract local subgraphs from both the positive sample graph and the negative sample graph, and derive their unique structural features through the GraphSAGE encoder layer and similarity calculation. Furthermore, we develop a malicious inference model at the feature level to capture potential malicious correlations leveraging meta-paths and meta-structures. Lastly, to obtain the most pertinent features for downstream classification tasks, an adaptive attention mechanism is incorporated in the final stage to derive the ultimate feature embeddings, which are then evaluated by the detection model. Our model achieved a higher classification recall rate of 95.65% and a superior F1-score of 96.53%.