An Explainable Multi-Modal Hierarchical Attention Model for Developing Phishing Threat Intelligence

Phishing website attack, as one of the most persistent forms of cyber threats, evolves and remains a major cyber threat. Various detection methods (e.g., lookup systems, fraud cue-based methods) have been proposed to identify phishing websites. The limitations of lookup systems (e.g., failing to address newly created attacks) and the fraud cue-based methods (e.g., relying on feature engineering) motivated the development of deep representation-based methods capable of learning deep fraud cues for enhanced anti-phishing capacity. Focusing mostly on URLs, these methods fail to analyze other two important modalities of website content: textual information and visual design. Moreover, the interpretability of these deep learning based methods is limited, reducing model trustworthiness and preventing relevant and actionable intelligence. As such, we propose a multi-modal hierarchical attention model (MMHAM) which jointly learns the deep fraud cues from the three major modalities of website content for phishing website detection. Specifically, MMHAM features an innovative shared dictionary learning approach for aligning representations from different modalities in the attention mechanism. In our evaluation experiments, the proposed MMHAM not only learned improved deep cues for enhanced phishing detection, but provided a hierarchical interpretability system from which we could develop phishing threat intelligence to inform phishing websites detection at different levels.

1 Introduction

Phishing threat intelligence has been an important aspect of cyber threat intelligence (CTI) for security operations centers (SOC) in organizations, as phishing has sustained as a major and pervasive cybersecurity concern to many electronic commerce (e-commerce) platforms [1]. Industry reports have shown that SOC analysts spend a significant amount of time on responding to phishing attacks [2], [3]. One of the most prevalent phishing attack types is the phishing website attack, which involves using a fraudulent website to steal victim users’ sensitive information such as accounts, passwords, and credit card details [4], [5], [6]. According to Anti-Phishing Working Group (APWG), the number of active phishing websites is about 18 thousand each quarter in recent years and the 2019 Q3 saw the highest number as 266,387. Despite the fluctuation of incident number from quarter to quarter, phishing websites remain a major threat to cybersecurity.