Life-long phishing attack detection using continual learning.

Area of Science:

• Cybersecurity
• Machine Learning
• Artificial Intelligence

Background:

• Phishing attacks pose a significant threat to digital security, leading to daily losses of credentials and assets.
• Traditional machine learning (ML) models for phishing detection degrade in performance over time due to evolving attack vectors and technological advancements.
• The dynamic nature of phishing necessitates adaptive detection strategies to maintain effectiveness.

Purpose of the Study:

• To investigate the performance degradation of traditional ML-based phishing detection models over time.
• To explore the efficacy of continual learning (CL) techniques in sustaining phishing detection performance.
• To compare the performance of CL algorithms against traditional ML and transfer learning (TL) approaches.

Main Methods:

• Collected phishing and benign samples from 2018-2020, creating six distinct datasets.
• Trained a vanilla neural network (VNN) using deep feature embedding of HTML content in a CL manner.
• Evaluated proposed CL algorithms against VNN models trained from scratch and using TL.

Main Results:

• CL algorithms demonstrated sustained accuracy over time, with a performance deterioration of only 2.45%.
• Traditional VNN models trained from scratch experienced a performance decline exceeding 20.65%.
• Transfer learning (TL) models showed a performance deterioration of 8%.

Conclusions:

• Continual learning (CL) is a highly effective strategy for maintaining robust phishing detection performance against evolving threats.
• CL significantly outperforms traditional ML and transfer learning methods in long-term phishing detection accuracy.
• Adaptive learning approaches are crucial for cybersecurity defenses to keep pace with evolving cyberattack methodologies.