Robust Phishing Detection Against Adversaries

SAAD AL-AHMADI

Computer Science Department

King Saud University

PO Box 51178, Riyadh 11543

SAUDI ARABIA

detection with a restricted adversarial scenario, as PUCNN has shown that an unrestricted attacker dominates.

To evaluate this adversarial scenario, we present a parameterized text-based mutation strategy used for

generating adversarial samples. These parameters tune the attacker’s restrictions. We have focused on text-

based mutation due to our focus on URL-exclusive models. The PUCNN model generally showed robustness

and performed well when the parameters were low, which indicates a more restricted attacker.

Key-Words: - Artificial intelligence, Convolutional Neural Network (CNN), Cyber Security, Phishing

Detection

Received: March 7, 2021. Revised: October 5, 2021. Accepted: December 8, 2021. Published: January 14, 2022.

considering phishing websites. Phishing websites

are attempts to impersonate other websites or

entities for various reasons, such as convincing

users to enter their personal information. Phishing

websites can be dangerous, especially for amateur

users.

There are various approaches in the literature

for protecting against phishing websites. One of

which is employing machine learning for the

automatic detection of phishing websites. However,

how the models would perform in these adversarial

situations.

In this paper, we are interested in evaluations

under adversarial situations. For the evaluations, we

propose the following simple adversarial scenario.

We assume the targets of phishing are in protected

networks, which may block the attacker or issue a

special warning if there are many detected phishing

attempts. This scenario effectively gives the attacker

a limited number of attempts. We assume that the

still fall for it. We choose this adversarial scenario

because it restricts the attacker, not necessarily

reflecting a common situation in practice. In less

restricted adversarial scenarios, it is easy for the

attacker to bypass detection, as seen in section 2.

Fig.1 illustrates the proposed adversarial scenario.

URL-exclusive models which depend on the URL

characters only. These models do not depend on any

third-party service or network connectivity. This

the adversarial scenario in comparison to numerical

features and other simpler features. In section 2, we

will discuss a simulating strategy which is not

applicable to textual features.

adversarial behavior. These parameters tune the

attacker's restrictions. Whereas smaller parameters

indicate a more restricted attacker. We use the

mutation strategy to evaluate PUCNN [2].

PUCNN is a state-of-the-art URL-only phishing

detection model based on a character level

Convolutional Neural Network (CNN) [3]. We

applied the proposed mutation strategy to the

phishing instances in the testing dataset from [2].

Finally, we report the relevant performance metric,

we discuss relevant CNN models which are

applicable to the problem of phishing URLs

detection.

Biggioa et al. [4] discussed three attacker goals

in adversarial machine learning. They are security

violation, attack specificity, and error specificity. In

compromise security metrics such as availability,

privacy, and integrity. To compromise the

availability, the attacker may use denial of service

misclassify specific types of instances (such as

phishing). In the error specificity, the attacker seeks

to increase a specific type of error. All these goals

also can apply to phishing detection. In this paper,

we are mainly interested in goals that affect the

accuracy of the model, such as attack specificity and

error specificity.

learning techniques, convolutional neural network

(CNN) and long short-term memory (LSTM) to

build a hybrid classification model named

Intelligent Phishing Detection System (IPDS). The

model targeted URLs and websites content such as

images, text, and frames, unlike our URL-based

model. The CNN+LSTM classifier was trained by

machine learning-based phishing detection solutions

in adversarial settings. In the investigations, they

concluded that machine learning phishing detection

is susceptible to adversarial learning techniques, on

which attackers attempt to fool the classifier through

manipulated input. They proposed simulating

attacks by generating adversarial samples using

direct feature manipulation on phishing instances.

The authors managed to drop the recall of well-

investigate the usage of the domain-exclusive

model. For generating an adversarial sample, a

value that has already appeared in another phishing

instance. This approach is not applicable to textual

features such as the URL. For phishing instances

that are correctly classified, all possible adversarial

samples are generated. The authors computed the

adversary cost with a tuple of two values: the

number of features modified and the Euclidean

distance between the phishing instance and the

adversarial sample.

The experiments by Shirazi et al. were on four

published phishing datasets. The first dataset

presence of HTTPS protocol, matching domain

name with copyright logo, and matching domain

name with the page title. The second dataset is by

Rami et al. [9]. The dataset includes 4898 legitimate

instances from Alexa and 6158 phishing instances

from PhishTank. The dataset includes 30 features,

which are from five categories: URL-based,

abnormal-based, HTML-based, JavaScript-based,

and domain-based features. The third dataset is by

Abdelhamid et al. [10], which contains 1350

245,385 phishing URLs from PhishTank and

245,023 legitimate URLs from Alexa top 1 million.

Their model achieves 95.61% accuracy using 10-

fold cross-validation. However, the authors used

only CANTINA+ [15] as their only benchmark. The

main problem is that CANTINA+ is not a state-of-

art model. Additionally, CANTINA+ is a non-URL

exclusive model. Although, the authors retrieved old

phishing pages to train and evaluate CANTINA+,

we believe that it is likely that many of these pages

no longer represent the phishing pages as they were

reported a long time before collection, which makes

the benchmark less useful. PDRCNN is similarly a

textual URL model and can be evaluated under the

Similarly, these CNN models can be applied to the

problem of phishing URL detection, and it is

possible to evaluate them under the proposed

adversarial scenario.

the model’s detection. This goal can also be

formulated as an error specificity goal, where the

attacker wants to decrease the true positive rate.

goal.

Like Shirazi et al., we assume that the attacker

knows about the selected features. In contrast, we

assume that the attacker does not know about the

model and does not care about it because we do not

want the attacker to utilize any properties of the

model, which may complicate our analysis.

a fixed number of usages of the predict function.

Unlike Shirazi et al., we had to limit the usage of the

predict function, thus increasing the restrictions on

the attacker because even with these restrictions, the

attacker is powerful as can be seen from Shirazi et

troubling as the computational complexity is what

limits the attacker. Nonetheless, a behavior of the

attacker having limited access is quite common, for

example, when an attacker attempts to phish

domain to any non-taken domain or changing the

visuals displayed by the web page is accessible to

the attacker, these changes affect how the victim

perceives the website. Thus, the attacker may not

consider them. Shirazi et al. do not directly mention

the concept of constraints. However, in their

mutation strategy, they specified that the attacker

could only mutate to values that appeared to other

phishing instances.

distribution where we assume that the attacker

uniformly chooses from the possible mutation types.

The attacker also uniformly chooses the letter to

insert, the letter to delete or the adjacent letters to

swap. We assume that the attacker can repeatedly

apply this mutation strategy, where we call the

number of repetitions the mutations number. Fig.3

illustrates our mutations strategy. It is also possible,

although unlikely that such mutations will result in

4.1 Statistical Measures

Four popular statistical measures for classification

models are precision, recall, accuracy, and F-

measure [18]. They are calculated as follows:

𝑃𝑟𝑒𝑐𝑖𝑠𝑖𝑜𝑛 = 𝑇𝑃

𝑅𝑒𝑐𝑎𝑙𝑙 = 𝑇𝑃

number of the model prediction of true positives,

true negatives, false positives, and false negatives,

respectively.

shows how TP, TN, FP, and FN relate to the

prediction and the actual value. In this paper, we

consider phishing as positive and legitimate as

Table 2. Confusion Matrix

phishing detection, high precision means a lower

number of legitimate websites classified as phishing

websites. In comparison, high recall means a lower

number of phishing websites that were classified as

legitimate. Both precision and recall are essential,

depending on the usage scenario. For example, it

may be preferable to have high precision on

personal devices, while on the other hand, for some

firewalls, it may be preferable to have a high recall.

F-measure is the harmonic mean of precision and

In this paper, we perform four experiments. In these

experiments, we continue our previous work and

utilize PUCNN. We also use the same training,

validation, and testing datasets that were randomly

split from the preprocessed MUPD dataset [2]. In

the first experiment, we preprocessed each URL and

converted it to its host string (Usually a domain or

an IP). We report the accuracy of the testing dataset,

and we compare it to the original URL-based

may be useful in some cases as it can simplify the

analysis.

Next, we discuss experiments 2-4. In these

experiments, we evaluated the original URL-based

PUCNN from [2] against the phishing instances in

the testing dataset after mutations. We note that we

only consider classification correct if all instances

generated from the same instance are classified

correctly. We performed the proposed mutations

strategy with all combinations of specific values of

mutations number and generation number. Table 3

lists the values we experimented with. However,

because of the huge increase in the generation

number, the number of instances increases. To do

the test, we performed sampling based on the

generation number instead. The sample size we used

is the size of the test dataset divided by the

generation number.

the URL. Whereas, in experiment 3, we performed

the mutation in the non-domain part of the URL.

Finally, in experiment 4, we performed the

whole URL mutations as a random uniform choice

between non-domain and domain mutations. This

means even if the non-domain part is long, and the

domain part is short they are getting mutated at the

same rate. Table 4 summarizes the experiments.

Using these experiments, we can find how the

evaluation is affected based on the mutation

location. In addition, we note that non-domain

In this section, we first show benchmarks between

the accuracies of URL-based PUCNN and domain-

based PUCNN. Then, we show how URL-based

PUCNN performs under our adversarial sampling.

Table 4. Setup of Experiments 2-4

From Fig.4 we note that PUCNN achieved

better accuracy when using domains directly instead

of URLs.

We can see how PUCNN performed well under

adversarial sampling in tables 5, 6, and 7. PUCNN

had the best results when the mutations were

exclusive to the domain. On the other hand, PUCNN

had the worst results in the experiments when the

mutations were allowed on the whole URL.

was, which may make the user doubts the URL.

These results imply that PUCNN is robust in this

scenario. However, this does not cover scenarios

where the attacker comes up with a new URL or

uses a more complex mutation strategy.

[2] A. Al-Alyan and S. Al-Ahmadi, “Robust URL

Lecture Notes in Bioinformatics), vol. 11559

LNCS, no. July, 2019, pp. 83–101.

[7] “Keyword research, competitor analysis, &

Oct. 07, 2018).

[8] “PhishTank - join the fight against phishing.”

https://www.phishtank.com/ (accessed Oct. 24,

2018).

[9] R. M. Mohammad, F. Thabtah, and L.

McCluskey, “An assessment of features related

to phishing websites using an automated

10.1016/j.eswa.2014.03.019.

[11] C. L. Tan, “Phishing Dataset for Machine

10.17632/h3cgnj8hft.1.

[12] “Download list of top 10 million domains

based on open data from common crawl &

https://www.domcop.com/top-10-million-

domains (accessed Jun. 28, 2019).

[13] O. K. Sahingoz, E. Buber, O. Demir, and B.