PhreshPhish: A Real-World, High-Quality, Large-Scale Phishing Website Dataset and Benchmark

TL;DR

This paper introduces PhreshPhish, a large, high-quality dataset and benchmark suite for phishing website detection, addressing limitations of existing datasets to enable more realistic and standardized evaluation of detection models.

Contribution

The paper presents a new large-scale, high-quality phishing dataset and a comprehensive benchmark suite designed for realistic model evaluation, reducing data leakage and increasing task difficulty.

Findings

Baseline models evaluated on the new benchmarks.

Significant improvements over existing datasets in data quality.

Benchmark results highlight challenges in phishing detection.

Abstract

Phishing remains a pervasive and growing threat, inflicting heavy economic and reputational damage. While machine learning has been effective in real-time detection of phishing attacks, progress is hindered by lack of large, high-quality datasets and benchmarks. In addition to poor-quality due to challenges in data collection, existing datasets suffer from leakage and unrealistic base rates, leading to overly optimistic performance results. In this paper, we introduce PhreshPhish, a large-scale, high-quality dataset of phishing websites that addresses these limitations. Compared to existing public datasets, PhreshPhish is substantially larger and provides significantly higher quality, as measured by the estimated rate of invalid or mislabeled data points. Additionally, we propose a comprehensive suite of benchmark datasets specifically designed for realistic model evaluation by minimizing leakage, increasing task difficulty, enhancing dataset diversity, and adjustment of base rates more likely to be seen in the real world. We train and evaluate multiple solution approaches to provide baseline performance on the benchmark sets. We believe the availability of this dataset and benchmarks will enable realistic, standardized model comparison and foster further advances in phishing detection. The datasets and benchmarks are available on Hugging Face (https://huggingface.co/datasets/phreshphish/phreshphish).