An effective detection approach for phishing websites using URL and HTML features.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Phishing websites present a significant and growing threat to internet users, aiming to steal sensitive information.
• Existing detection methods often struggle with highly undetectable phishing attempts.

Purpose of the Study:

• To propose a novel and effective approach for detecting phishing websites.
• To develop features that can identify zero-hour (0-h) attacks without relying on third-party services.

Main Methods:

• Extraction of URL character sequence features, hyperlink information, and webpage textual content.
• Utilizing character-level Term Frequency-Inverse Document Frequency (TF-IDF) features from HTML and plaintext.
• Training an XGBoost classifier with integrated features.
• Creation of a custom dataset of 60,252 webpages (32,972 benign, 27,280 phishing) for validation.

Main Results:

• Individual features demonstrated value in phishing detection.
• Integration of all proposed features significantly improved detection accuracy.
• Achieved 96.76% accuracy with a 1.39% false-positive rate on the custom dataset.
• Achieved 98.48% accuracy with a 2.09% false-positive rate on a benchmark dataset, outperforming existing methods.

Conclusions:

• The proposed feature set and XGBoost classifier offer a robust solution for anti-phishing.
• The approach effectively detects sophisticated phishing attacks, including zero-hour threats.
• The method enhances online security by providing a highly accurate and efficient phishing detection system.