Exploring the Efficacy of Federated-Continual Learning Nodes with Attention-Based Classifier for Robust Web Phishing Detection: An Empirical Investigation

TL;DR

This paper introduces a hybrid federated-continual learning framework with an attention-based classifier for web phishing detection, demonstrating superior accuracy and robustness in identifying evolving phishing threats without data sharing.

Contribution

It presents a novel hybrid learning paradigm combining federated and continual learning, along with a new attention-based model tailored for phishing detection, outperforming traditional methods.

Findings

Achieved 0.93 accuracy and 0.90 precision with the LwF strategy.

Outperformed traditional approaches in detecting emerging phishing threats.

Effectively retained past knowledge while adapting to new data.

Abstract

Web phishing poses a dynamic threat, requiring detection systems to quickly adapt to the latest tactics. Traditional approaches of accumulating data and periodically retraining models are outpaced. We propose a novel paradigm combining federated learning and continual learning, enabling distributed nodes to continually update models on streams of new phishing data, without accumulating data. These locally adapted models are then aggregated at a central server via federated learning. To enhance detection, we introduce a custom attention-based classifier model with residual connections, tailored for web phishing, leveraging attention mechanisms to capture intricate phishing patterns. We evaluate our hybrid learning paradigm across continual learning strategies (cumulative, replay, MIR, LwF) and model architectures through an empirical investigation. Our main contributions are: (1) a new hybrid federated-continual learning paradigm for robust web phishing detection, and (2) a novel attention + residual connections based model explicitly designed for this task, attaining 0.93 accuracy, 0.90 precision, 0.96 recall and 0.93 f1-score with the LwF strategy, outperforming traditional approaches in detecting emerging phishing threats while retaining past knowledge.