Adversarial-resilient lightweight phishing url detection: Evaluating lexical & metadata features under evasion...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Phishing attacks utilize deceptive URLs to bypass traditional detection methods.
• Existing machine learning models often fail against adversarial URL evasion techniques.
• Real-world phishing detection requires robustness against obfuscation, encoding manipulation, and other evasive strategies.

Purpose of the Study:

• To develop a robust phishing URL detection model resilient to adversarial evasion methods.
• To address the limitations of current models evaluated under non-adversarial conditions.
• To propose a lightweight and deployable solution for enhanced cybersecurity.

Main Methods:

• Modeled phishing URL detection as a lightweight binary classification problem with an adversarial threat model.
• Utilized lexical, structural, and metadata-based URL features, avoiding raw strings and deep packet inspection (DPI).
• Proposed the Adversarial-Resilient Lightweight Random Forest (AR-LRF) model incorporating simulated adversarial perturbations during training.

Main Results:

• The AR-LRF model achieved 99.78% accuracy and 0.9999 ROC-AUC on clean data.
• Demonstrated significantly lower performance degradation compared to baseline classifiers under adversarial conditions.
• Validated model resilience through feature importance and confidence stability analyses.

Conclusions:

• The AR-LRF model offers a viable, lightweight, and deployable tool for detecting phishing URLs.
• It effectively mitigates adversarial vulnerabilities common in real-world cyber threats.
• The proposed method enhances modern cybersecurity infrastructure by providing robust defense mechanisms.