Phishing Website Detection through Multi-Model Analysis of HTML Content

TL;DR

This paper presents a multi-model approach combining NLP and MLP techniques for detecting phishing websites based on HTML content, achieving high accuracy and creating a new, relevant dataset.

Contribution

It introduces a novel multi-model fusion method for phishing detection and provides an up-to-date, real-world dataset for the research community.

Findings

The proposed MultiText-LP model achieves 96.80 F1 score.

Fusion of NLP and MLP models outperforms existing methods.

CANINE and RoBERTa models excel in analyzing titles and content.

Abstract

The way we communicate and work has changed significantly with the rise of the Internet. While it has opened up new opportunities, it has also brought about an increase in cyber threats. One common and serious threat is phishing, where cybercriminals employ deceptive methods to steal sensitive information.This study addresses the pressing issue of phishing by introducing an advanced detection model that meticulously focuses on HTML content. Our proposed approach integrates a specialized Multi-Layer Perceptron (MLP) model for structured tabular data and two pretrained Natural Language Processing (NLP) models for analyzing textual features such as page titles and content. The embeddings from these models are harmoniously combined through a novel fusion process. The resulting fused embeddings are then input into a linear classifier. Recognizing the scarcity of recent datasets for comprehensive phishing research, our contribution extends to the creation of an up-to-date dataset, which we openly share with the community. The dataset is meticulously curated to reflect real-life phishing conditions, ensuring relevance and applicability. The research findings highlight the effectiveness of the proposed approach, with the CANINE demonstrating superior performance in analyzing page titles and the RoBERTa excelling in evaluating page content. The fusion of two NLP and one MLP model,termed MultiText-LP, achieves impressive results, yielding a 96.80 F1 score and a 97.18 accuracy score on our research dataset. Furthermore, our approach outperforms existing methods on the CatchPhish HTML dataset, showcasing its efficacies.