Phishing URL Detection via CNN and Attention-Based Hierarchical RNN

Phishing websites have long been a serious threat to cyber security. For decades, many researchers have been devoted to developing novel techniques to detect phishing websites automatically. While state-of-the-art solutions can achieve superior performances, they require substantial manual feature engineering and are not adept at detecting newly emerging phishing attacks. Therefore, developing techniques that can detect phishing websites automatically and handle zero-day phishing attacks swiftly is still an open challenge in this area. In this work, we propose PhishingNet, a deep learning-based approach for timely detection of phishing Uniform Resource Locators (URLs). Specifically, we use a Convolutional Neural Network (CNN) module to extract character-level spatial feature representations of URLs; meanwhile, we employ an attention-based hierarchical Recurrent Neural Network(RNN) module to extract word-level temporal feature representations of URLs. We then fuse these feature representations via a three-layer CNN to build accurate feature representations of URLs, on which we train a phishing URL classifier. Extensive experiments on a verified dataset collected from the Internet demonstrate that the feature representations extracted automatically are conducive to the improvement of the generalization ability of our approach on newly emerging URLs, which makes our approach achieve competitive performance against other state-of-the-art approaches.

I. Introduction

According to Anti-Phishing Working Group (APWG), a not-for-profit industry association focused on eliminating the identity theft and frauds that result from the growing problem of phishing, crimeware, and email spoofing, phishing is a criminal mechanism which employs both social engineering and technical subterfuge to steal customers’ personal identity information and financial account data. Recent years have witnessed the rapid growth of phishing attacks. As reported by APWG [1], the number of detected phishing attacks in the first half of the year 2018 was 496,578, compared to 371,519 in the second part of 2017, resulting in over 33% growth in half a year. Phishing has become a severe problem because of the serious damage caused to its targeted industry, e.g., payment, financial institution, email, etc. Estimates of annual direct economic loss to the American economy due to phishing attacks are between 61 million dollars and 3 billion dollars [2].