Phishing URL Detection Via Capsule-Based Neural Network

As a cyber attack which leverages social engineering and other sophisticated techniques to steal sensitive information from users, phishing attack has been a critical threat to cyber security for a long time. Although researchers have proposed lots of countermeasures, phishing criminals figure out circumventions eventually since such countermeasures require substantial manual feature engineering and can not detect newly emerging phishing attacks well enough, which makes developing an efficient and effective phishing detection method an urgent need. In this work, we propose a novel phishing website detection approach by detecting the Uniform Resource Locator (URL) of a website, which is proved to be an effective and efficient detection approach. To be specific, our novel capsule-based neural network mainly includes several parallel branches wherein one convolutional layer extracts shallow features from URLs and the subsequent two capsule layers generate accurate feature representations of URLs from the shallow features and discriminate the legitimacy of URLs. The final output of our approach is obtained by averaging the outputs of all branches. Extensive experiments on a validated dataset collected from the Internet demonstrate that our approach can achieve competitive performance against other state-of-the-art detection methods while maintaining a tolerable time overhead.

I. Introduction

According to Anti-Phishing Working Group (APWG)^[1], phishing is a cyber attack that employs both social engineering and sophisticated technical subterfuge to steal users' private information like financial data. Usually, criminals use spoofed e-mails or other messages to lead users to counterfeit websites which are designed to lure users into divulging their private information like financial data. Recent decades have witnessed a dramatic growth of phishing attacks. As reported by APWG^[2], the number of phishing websites detected in the first quarter 2019 was 180,768, which was up remarkably from the 138,328 seen in the fourth quarter 2018, and from the 151,014 seen in the third quarter 2018. Phishing has caused severe damage to many industries, e.g., Software-as-a-Service (SaaS) and webmail services, payment, financial institution, etc. According to the Federal Bureau of Investigation (FBI)‘s latest report^[3], there was a 136% increase in identified exposed losses from December 2016 to May 2018, and the loss due to phishing attacks has reached 12.5 billion dollars worldwide.