Web Phishing Net (WPN): A scalable machine learning approach for real-time phishing campaign detection

TL;DR

This paper introduces a scalable, privacy-preserving unsupervised machine learning method for real-time detection of phishing campaigns, including AI-generated threats, outperforming traditional approaches in speed and detection rate.

Contribution

The paper presents a novel unsupervised learning approach that is scalable, fast, and capable of detecting entire phishing campaigns without pair-wise comparisons, addressing limitations of existing methods.

Findings

High detection rate for phishing campaigns

Effective against AI-generated phishing URLs

Scalable and privacy-preserving detection method

Abstract

Phishing is the most prevalent type of cyber-attack today and is recognized as the leading source of data breaches with significant consequences for both individuals and corporations. Web-based phishing attacks are the most frequent with vectors such as social media posts and emails containing links to phishing URLs that once clicked on render host systems vulnerable to more sinister attacks. Research efforts to detect phishing URLs have involved the use of supervised learning techniques that use large amounts of data to train models and have high computational requirements. They also involve analysis of features derived from vectors including email contents thus affecting user privacy. Additionally, they suffer from a lack of resilience against evolution of threats especially with the advent of generative AI techniques to bypass these systems as with AI-generated phishing URLs. Unsupervised methods such as clustering techniques have also been used in phishing detection in the past, however, they are at times unscalable due to the use of pair-wise comparisons. They also lack high detection rates while detecting phishing campaigns. In this paper, we propose an unsupervised learning approach that is not only fast but scalable, as it does not involve pair-wise comparisons. It is able to detect entire campaigns at a time with a high detection rate while preserving user privacy; this includes the recent surge of campaigns with targeted phishing URLs generated by malicious entities using generative AI techniques.