Using network structure and community detection to discover important website features when distinguishing between phishing and legitimate ones

TL;DR

This paper introduces a novel network-based method using community detection to identify key website features for distinguishing phishing from legitimate sites, enhancing detection accuracy and speed.

Contribution

It presents the first use of a network-based approach for feature selection in phishing detection, leveraging correlation networks and hub analysis.

Findings

Network hubs correlate with important phishing features

Method achieves high accuracy on established dataset

Fast feature selection compared to traditional methods

Abstract

In this paper, we uncover the essential features of websites that allow intelligent models to distinguish between phishing and legitimate sites. Phishing websites are those that are made with a similar user interface and a near similar address to trustworthy websites in order to persuade users to input their private data for potential future misuse by attackers. Detecting phishing websites with intelligent systems is an important goal to protect users, companies, and other online services that use the HTTP protocol. An intelligent model needs to distinguish features that are important as input to predict phishing sites. In this research, using correlation-based networks, we provide a novel network-based method to find features that are more important in phishing detection. The networks are trained and tested on an established phishing dataset. Three different networks are made by partitioning the dataset by its data instance labels. The important features are found by discovering the hubs of these networks, and the results are presented and analysed. This is the first time using a network-based approach for feature selection which is a fast and accurate way to do so.