An Effective Phishing Detection Model Based on Character Level Convolutional Neural Network from URL

TLDR

Phishing exploits lure users into revealing credentials via emails, messages, or calls, and current defenses rely on source‑code scraping or slow third‑party services, while machine‑learning approaches demand manual feature engineering and struggle with new attacks. In this paper, a fast deep‑learning solution using a character‑level CNN on URLs is proposed. The model learns sequential patterns from raw URL strings with a character‑level CNN, avoiding content retrieval or third‑party services, and is evaluated against traditional and deep‑learning baselines using hand‑crafted, embedding, TF‑IDF, and count‑vector features. The model achieved 95.02 % accuracy on the authors’ dataset and 98.58 %, 95.46 %, and 95.22 % on benchmark datasets, outperforming existing phishing‑URL models.

Abstract

Phishing is the easiest way to use cybercrime with the aim of enticing people to give accurate information such as account IDs, bank details, and passwords. This type of cyberattack is usually triggered by emails, instant messages, or phone calls. The existing anti-phishing techniques are mainly based on source code features, which require to scrape the content of web pages, and on third-party services which retard the classification process of phishing URLs. Although the machine learning techniques have lately been used to detect phishing, they require essential manual feature engineering and are not an expert at detecting emerging phishing offenses. Due to the recent rapid development of deep learning techniques, many deep learning-based methods have also been introduced to enhance the classification performance. In this paper, a fast deep learning-based solution model, which uses character-level convolutional neural network (CNN) for phishing detection based on the URL of the website, is proposed. The proposed model does not require the retrieval of target website content or the use of any third-party services. It captures information and sequential patterns of URL strings without requiring a prior knowledge about phishing, and then uses the sequential pattern features for fast classification of the actual URL. For evaluations, comparisons are provided between different traditional machine learning models and deep learning models using various feature sets such as hand-crafted, character embedding, character level TF-IDF, and character level count vectors features. According to the experiments, the proposed model achieved an accuracy of 95.02% on our dataset and an accuracy of 98.58%, 95.46%, and 95.22% on benchmark datasets which outperform the existing phishing URL models.