2022 IEEE International Conference on Cyber Security and Resilience (CSR) Workshops

Phishing Detection Using Machine Learning

Algorithm.
2022 IEEE International Conference on Cyber Security and Resilience (CSR) | 978-1-6654-9952-1/22/$31.00 ©2022 IEEE | DOI: 10.1109/CSR54599.2022.9850316

Jibrilla Tanimu Stavros Shiaeles

Department of Computing Department of Computing
University of Portsmouth University of Portsmouth
[Link]@[Link] sshiaeles@[Link]

Abstract - The rapid increase of phishing attacks has led understand a newly developed website that is not registered,
individuals and organizations losing billions of dollars as well as and this could also contribute to misclassification. The current
worried about the confidentiality and privacy of their data. This innovative approach to classifying phishing activity is the
tremendous annual increase of phishing attacks shows that the utilisation of URL and web content features with a machine
current detection methods available are not sufficient, therefore
learning approach to improve detection accuracy and
more effective phishing detection methods should be developed.
This paper proposed a novel phishing detection model using performance.
machine learning, to improve efficacy and accuracy in phishing
detection. This paper explores the current state-of-the-art in Alabdan [1] suggested that frequent system updates and regular
phishing detection along with their drawbacks and proposes a new training of staff on new phishing activities will massively
novel method based on image visualisation of website code and reduce the number of phishing attacks in an organization.
features extraction from malicious URLs which is under
development.
In this paper, we aim to provide a solution to the limitations
Index Terms - Machine learning, Phishing detection, aforementioned in the related works by proposing an extensive
Images, Binary visualisations, Spam phishing detection using a machine learning approach. Using
image classification with some selected features, such as
I. INTRODUCTION domain base features, address bar-based features, abnormal-
based features and HTML base features combined with
Companies are losing 100 billion dollars per year phishing website URLs to create an image used in our proposed
because of phishing and even worse, phishing attacks are model to perform prediction with different classification
increasing every year by 200%. This leads to a conclusion that algorithms. To archive high efficiency and efficacy.
the current solutions available are not adequate, and new
methods should be developed to protect companies and end- The paper is organised as follows: Section 2 provides the
users. Many financial activities are computerized and less cash related work done in the research area and what needs to be
is available which led to the new trend of phishing and other done (drawback). While in Section 3, we present the proposed
cybercrimes, defrauding internet users is the new trend, to method, the feature that will be used along with the image
collect their financial credentials. In recent times many criminal classification, while Section 4 presents the stage that has been
organizations have shifted from exploiting system implemented and finally, Section 5, concludes the paper and
vulnerabilities in information systems to human's inability to presents the future work.
differentiate between legitimate and fake online resources such
as email and websites. This makes it significantly important to II. RELATED WORK
provide a solution to mitigate the problems.
Different methods and approaches have been explored
The need for an efficient solution has made phishing detection to understand and provide a solution to phishing attacks. In this
a favourable research area in recent times, with the unfolding of respect, many papers are available that examine strategies
the visual similarities approach, blacklisting and whitelisting adopted by phishers or attackers, but here we will be focused
approach, website content and URL features. The visual on the most relevant papers that provide the best accuracy.
similarities utilise extraction of features from a website and re- Barlow et al. [2] present a comprehensive novel approach for
use them for phishing website identification; this method is detecting phishing attacks using binary visualisation and
ineffective as any misrepresentation of a web page's content machine learning. The authors highlight the need for fast access
affects the visual content leading to misclassification. The time so that the proposed method to be functional in a real-time
blacklisting and whitelisting are also ineffective in classifying environment and also have a high detection rate. This was
phishing and non-phishing website; however, the system cannot achieved by combining phishing threats with binary

978-1-6654-9952-1/22/$31.00 ©2022 IEEE

317
Authorized licensed use limited to: Zhejiang University. Downloaded on April 06,2025 at 14:23:02 UTC from IEEE Xplore. Restrictions apply.
visualisation and machine learning. Adebowale et al. [3] phishing detection techniques based on natural language
present an article on different types and methods of phishing technique and machine learning in a data-driven approach
attacks as well as new ways to mitigate them. The article claims presented to be of great effectiveness and higher accuracy than
to have achieved 95.83% accuracy in detecting phishing those depending on filtering rules and also augured that their
attacks. proposed solution is very effective and good enough to identify
Luga et al. [4] Analyse data to understand the percentage of and mitigate phishing attacks.
users that fall victim to phishing attacks by analysing data and According to [7] a novel model for the detection of phishing
finding that 65.63% of users will undoubtedly fall victim to websites similar to Kumar & Gupter [8] is proposed. Both
phishing scammers. Some of the data used were Gender, papers are using features from websites in order to detect
Computer manufacture date, Operating system, etc. in addition phishing and they compare their result with CANTINA and
to individual page course analysis with correlated detection CANTINA+ to show the effectiveness of their proposed model.
scores. The models identify phishing sites on features extraction from
Almseidin et al. [5] implement a prototype for phishing URL content and other third-party resources such as machine
detection using machine learning and testing it with 500 fake learning algorithms. According to the authors, the proposed
and 500 legitimate web pages. The paper concludes that method achieved a 99.55% detection rate and a very low false-
Random Forest is the best classifier to be used as it was able to positive rate of 0.45% utilising the Random Forest Algorithm.
detect a phishing attack in 2.44 seconds and with 98.11 The research uses a mode that uses phishing sites, which is a
accuracy. The article filter the assigned data to increase replica of the legitimate site by placing some of the content with
performance and reduce computation time. Some of the an image which they believe a lot of research articles neglect to
classifiers used in this research work are Net, Naive Bayes J48, put into consideration.
Logistic, Random Forest, Bagging and multiple perceptions. Also, Basit et al [9] present a prototype for detecting phishing
Gualberto et al. [6] discuss different email phishing attacks and attacks on a website using the Machine learning algorithm by
focused on the natural language processing (NLP) technique in examining three major machine learning classifiers which are:
conjunction with the machine learning approach. The authors K- Nearest Neighbour (K-NN), Artificial Neuron Network
achieved a 99.95 accuracy using XGBoost Algorithm. (ANN) and Decision Tree (C4.5) to cast with Random Forest
Furthermore, the authors dealt and compared with different Classifiers (RFC). The paper suggests RFC has the highest
classifiers such as Multilayer perception (MLP), Support detection accuracy reaching 97.33% when compared to other
Vector Machines (SVM), Logic regression for Classification classifiers. For the experiment, 4898 legitimate and 6157
(LRC), K-Nearest Neighbour (KNN), Random Forest (RF), phased websites were used and they also conclude that putting
Decision Tree (DT), Extreme Gradient Boosting (XGBoost) more variables into the process will improve the detection
and Multilayer perception (MLP). The article summarised accuracy.

Table 1:Overview of the prior research

Record of survey papers based on classifications

Reference Solutions Approach Limitations Accuracy Future enhancement
[2] Phishing and Uses the Dataset use to 95.89% Adding more
non- non combination of conduct the dataset for both
phishing website neural network experiment was training and
classification. with binary 4,000 which testing and also
visualization limit the trying different
predication and model in making
affect the predictions
efficacy of the
model
[10] Phishing URL Introduce IT literate were 85.17% Simulation
Detection TOROEDO to used to carry out Phishing environment need
map out existing research Detection to be available for
email phishing user testing
problems
[11] Phishing User training to There were no Not stated. It could also be
detection/ increase matrices for end Increase extension in
offensive defence awareness on user evaluation awareness level enhancing anti-
phishing for each website of users. Though phishing training
it acknowledges
machine learning
as the most

318
Authorized licensed use limited to: Zhejiang University. Downloaded on April 06,2025 at 14:23:02 UTC from IEEE Xplore. Restrictions apply.
 prominent
approach
[12] Automatic data Role in detecting Some of the 95.2% precision Future research of
collecting and phishing processes were and 91.6 recall in this kind needs to
security analysis activities using not clearly phishing enhance early
random forest demonstrated detection. detection of
till the final phishing activities
stage
[13] Phishing Blacklist A lot phishing Not applicable Incorporate other
detection and approach, cloud- detection It is a literature phishing detection
mitigation in threat inspection method such as publication technique such as
emails/website approach. rule base SVN, K-nearest
method, neighboured in
decision tree, solving
associative
classification,
SVM, NN were
listed but none
have been
demonstrated in
the research.
[14] Cyber security Using place Logical analysis Not applicable The research
awareness and management revealed very Awareness and generally focusses
training approach to few differences training of on training, so the
investigate in among control individual in need to
cybercrime variable that phishing continuous train
were included in detection. consumers of the
the overall internet should be
research, which improve and
increase the maintain, for
possibility of the feature security
research not implementation in
capturing some that aspect.
other variables
[15] The architecture Deep Neuro The result Not applicable To expand the
and working style fuzzy classifier generated by clustering using research to see
of ANFIS and approach; which DNN has huge Neuro fuzzy how the issues of
DNN were divided in setback as it was model not simply to
to different not transparent understand is been
segment; MF, and not easy to mitigated.
fuzzification understand.
part, deep
learning part.

In summary, researchers extensively involved with the subject These kinds of approaches can only classify based on the given
tried to mitigate phishing attacks by proposing a novel tag or text formatting and so forth, this kind of classification
technique that has a regular detection rate, not much better than may lead to ambiguity as the entity that is not defined in the
the already existing result, also they fail to answer the research model will not be classified, which will affect the efficacy and
question in some cases the result comes with medium accuracy efficiency of the classification.
but high false positive. Similarly, some literature shows how extensively the
Some research adapts feature extractions such as researchers attempt to invest in whitelisting and blacklisting of
visual similarities between phishing and legitimate website in the domain, to enable them to classify addresses from phishing
their studies, entities such as text content, Cascading style sheet or legitimate sender, this kind of study is very vulnerable to
(CSS), HTML tags, text formatting and so forth, were used to misclassification and increase the rate of false alarm, in case of
classify between legitimate and phishing websites, most of the new un-registered address, whitelisting and blacklisting cannot
time the solution was implemented without considering the classify new unregistered phishing or non-phishing website.
importance of classification accuracy or recognition speed.

319
Authorized licensed use limited to: Zhejiang University. Downloaded on April 06,2025 at 14:23:02 UTC from IEEE Xplore. Restrictions apply.
 In this research, we aim to address the above- to accelerate detection time without compromising detection
mentioned issues by combining features and HTML code of accuracy. This will be discussed further in the Implementation
80,000 phishing websites to create unique images and train a Section below.
machine learning model so it could identify malicious websites
with high accuracy in real-time. The feature of the proposed Currently, the following machine learning classifiers are
solution is provided in the Section below. considered based on literature review which is: Decision tree,
Support Vector Machine, Naïve base, 2D and 3D Neural
III. PROPOSED METHOD Networks, TensorFlow and some newly proposed algorithms
such as artificial general intelligence (AGI). Our goal is to
This Section provides our proposed model that is currently improve the detection accuracy and time taken for the
under development as shown in Fig 1. The first component is classification and compare them with the most promising
a crawler. This component is crawling continuously Phish Tank methods proposed in the literature.
and storing all the actual Phishing websites in the database.
These websites are then parsed with another program where Table 2:Some of the feature of phishing and non-phishing website in the
dataset
features are collected and constructed into a unique image that
is feeding the machine learning in order to provide a decision.
S/N Features Possible values
Table 2 shows some of the features we found based on our
1 LinksInTags 1,-1,0
extensive literature review. In Fig. 2 a quick overview of the
current phishing URLs is provided and some features can be 2 AbnormalURL 1, -1
exported like IPAddress, Second level domain etc. 3 AgeOf Domain 1,-1
4 Port 1,-1
5 RightClickDisabled 1,-1
6 PopUpWindows 1,-1
7 EmbeddedBrandName 1,-1
8 SubdomainLevel 1,-1
9 Redirect page 1,-1
10 IpAddress -1,1
11 PctExtResourceUrls 1,-1
12 InsecureForms -1,1
13 double slash redirecting -1,1
14 FrequentDomainNameMismatch 1,-1
Fig. 2: URL features 15 UrlLengthRT 1,-1
16 ExtMetaScriptLinkRT 1,-1
During the machine learning progress in order to make the best
17 Using pop-up window 1,-1
prediction, we will test different classification algorithms to
18 DoubleSlashInPath -1,1
understand their performance and improve their accuracy by
optimising the image creation. 19 MissingTitle 1,-1
20 Page Rank 1,-1
21 SSLfinal State 1,0,-1
22 FakeLinkInStatusBar 1,1-
23 RandomString -1,1
24 HostnameLength 1,-1
25 QueryLength 1,-1
26 NoHttps 1,-1
27 Links pointing to page -1,0,1
28 NumHash 1,-1
29 IframeOrFrame -1,1
30 InsecureForms -1,1

IV. IMPLEMENTATION
Fig. 1: Phishing Detection Proposed Model
The first step in our proposed method is the crawler which is
implemented and is used to continuously retrieve phishing data
Another important part of the procedure is feature elimination, from Phish Tank and add them into the MySQL database (Fig.
which would enable us to remove the less significant features 4) for further data manipulation. The crawler can handle a large
that exist in the dataset and improve visualisation as well as amount of data, using python programming language running
picture creation speed. This would also help machine learning on an Ubuntu 20.04 LTS, 2 cores, 8 GB or Ram Virtual

320
Authorized licensed use limited to: Zhejiang University. Downloaded on April 06,2025 at 14:23:02 UTC from IEEE Xplore. Restrictions apply.
Machine. Python was selected because it makes development The feature importance method
faster and easier by utilising packages such as MySQL is a bagged decision tree such as a random forest and extra tree
connector for the database connection, Pandas and other used to estimate the importance of the features and eliminate
libraries which simplify our work. Libraries such as Scikit- the less important feature. The importance of each feature in the
learn, NumPy and Pandas will be utilized as well for the decision tree is calculated as:
Machine learning implementation. ∑ : !" #
∑$∈&'' ()*+ $

fi sub (i) = the importance of feature i

ni sub (j) = the importance of node j

Univariate selection method

This approach statistical test would be utilised to select those
features that have the strongest features with the output
Fig. 1: Crawler code, collecting Phishing data from phish Tank variables, that have a significant impact factor on the feature in
the proposed model. The univariate score statistic is:
For the last months, the crawler was running continuously, 1
collecting both legitimate and phishing websites. The current ,- ./ - , - /, - 2
amount of data reaches 30000 malicious and benign URLs that
contain the sub-entities shown in Fig. 2. These data will be used The heatmap
later for the training and testing of our proposed model. The approach also enables the visualising feature provided in
the model by finding the correlation between all the values, a
feature 1 also known as dependant variable y1 takes all the
values in feature 2 also known as dependant y2 which takes:
, 45 µ µ 7
3 , ,
. . . .
As shown in figure 5, is a sample approach to implementing
heatmap using python.
Fig. 2: Data from MySQL database showing data collected

The feature Elimination method is the next step in our proposed

solution. Currently, this step is not implemented as we are in
the state of looking at various methods available, the right sets
of features would be determined by the features elimination
prosses to select the most significant features. Below are the Fig. 5: Plotting correlation with Heatmap
most prominent methods that have been investigated and will
be tested.
We aim to test all the aforementioned feature elimination
Recursive feature elimination methods in order to narrow down the number of features and
Works by recursively removing attributes and building a model select the most appropriate method for the proposed algorithms.
on the remaining attribute, which makes it suitable to remove This way our image creation process will receive only
the redundant phishing attribute in the proposed model. important data thus we will reduce the image creation time and
We represent RFE as: overfitting.
.
The final component of the proposed solution is image creation.
Images are created based on the features identified above and
The principal component analysis
the intention is to find commonalities between the various
(PCA) method utilises linear algebra to transform data into a
website image samples. These images will be used to feed the
compressed form also known as the data reduction technique.
final machine learning component where we will train and test
Which makes it an essential approach to reduce the less relevant
our neural network utilising the TensorFlow and other machine
features and save time
learning algorithms dedicated to image recognition as identified
We can use the covariance of X and Y using the following:
1 above. We will compare their output results in terms of
, accuracy and we will then conclude on which machine learning
1 algorithm we will be focusing our further research in order to
achieve higher accuracy.

321
Authorized licensed use limited to: Zhejiang University. Downloaded on April 06,2025 at 14:23:02 UTC from IEEE Xplore. Restrictions apply.
 V. CONCLUSION AND FUTURE WORK
[6] E. S. Gualberto, R. T. de Sousa, T. P. B. de Vieira, J. P.
Phishing is an important threat in the corporate C. L. da Costa, and C. G. Duque, “From Feature
environment causing many financial losses. Even if many Engineering and Topics Models to Enhanced
solutions have been proposed and utilised by well-known cyber Prediction Rates in Phishing Detection,” IEEE Access,
security companies, the rapid increase of successful phishing vol. 8, pp. 76368–76385, 2020, doi:
attacks is an indicator that is insufficient to tackle the problem. 10.1109/ACCESS.2020.2989126.
The current phishing detection and mitigation method proposed [7] R. S. Rao, • Alwyn, and R. Pais, “Detection of phishing
in this paper will enhance previous work by providing better websites using an efficient feature-based machine
results and accuracy. The proposed method is still under learning framework,” Neural Computing and
development and a huge dataset of phishing and legitimate Applications, vol. 31, doi: 10.1007/s00521-017-3305-
websites is been collected. The next step is to utilise the feature 0.
elimination techniques identified in Section IV, which include [8] A. Kumar Jain and B. B. Gupta, “Towards detection of
Recursive feature elimination, Principal component analysis, phishing websites on client-side using machine
feature importance and Univariant selection method and learning based approach,” vol. 68, pp. 687–700, 2018,
proceed with creating images and training our machine learning doi: 10.1007/s11235-017-0414-0.
models to measure the efficiency and efficacy of our new [9] A. Basit, M. Zafar, A. R. Javed, and Z. Jalil, “A Novel
model, compared with previous studies. Ensemble Machine Learning Method to Detect
Phishing Attack,” Nov. 2020. doi:
ACKNOWLEDGEMENT
10.1109/INMIC50486.2020.9318210.
This project has received funding from Petroleum [10] M. Volkamer, K. Renaud, B. Reinheimer, and A. Kunz,
Technology Development Funds (PTDF) Nigeria. The work “User experiences of TORPEDO: TOoltip-poweRed
reflects the author's view not the organizational view regarding Phishing Email DetectiOn,” Computers and Security,
their findings. vol. 71, pp. 100–113, Nov. 2017, doi:
10.1016/[Link].2017.02.004.
REFERENCES [11] M. Khonji, Y. Iraqi, and A. Jones, “Phishing detection:
[1] R. Alabdan, “future internet Phishing Attacks Survey: A literature survey,” IEEE Communications Surveys
Types, Vectors, and Technical Approaches”, doi: and Tutorials, vol. 15, no. 4. pp. 2091–2121, 2013. doi:
10.3390/fi12100168. 10.1109/SURV.2013.032213.00009.
[2] L. Barlow, G. Bendiab, S. Shiaeles, and N. Savage, “A [12] L. Gallo, A. Maiello, A. Botta, and G. Ventre, “2 Years
Novel Approach to Detect Phishing Attacks using in the anti-phishing group of a large company,”
Binary Visualisation and Machine Learning,” in Computers and Security, vol. 105, Jun. 2021, doi:
Proceedings - 2020 IEEE World Congress on Services, 10.1016/[Link].2021.102259.
SERVICES 2020, Oct. 2020, pp. 177–182. doi: [13] Y. Al-Hamar, H. Kolivand, and A. Al-Hamar,
10.1109/SERVICES48979.2020.00046. “Phishing attacks in Qatar: A literature review of the
[3] M. A. Adebowale, K. T. Lwin, E. Sánchez, and M. A. problems and solutions,” in Proceedings - International
Hossain, “Intelligent web-phishing detection and Conference on Developments in eSystems
protection scheme using integrated features of Images, Engineering, DeSE, Oct. 2019, vol. October-2019, pp.
frames and text,” Expert Systems with Applications, 837–842. doi: 10.1109/DeSE.2019.00155.
vol. 115. Elsevier Ltd, pp. 300–313, Jan. 01, 2019. doi: [14] S. Back and R. T. Guerette, “Cyber Place Management
10.1016/[Link].2018.07.067. and Crime Prevention: The Effectiveness of
[4] C. Iuga, J. R. C. Nurse, and A. Erola, “Baiting the hook: Cybersecurity Awareness Training Against Phishing
factors impacting susceptibility to phishing attacks,” Attacks,” Journal of Contemporary Criminal Justice,
Human-centric Computing and Information Sciences, 2021, doi: 10.1177/10439862211001628.
vol. 6, no. 1, Dec. 2016, doi: 10.1186/s13673-016- [15] F. Roohi and M. Phil, “NEURO FUZZY APPROACH
0065-2. TO DATA CLUSTERING: A FRAMEWORK FOR
[5] M. Almseidin, A. M. Abu Zuraiq, M. Al-kasassbeh, and ANALYSIS,” 2013.
N. Alnidami, “Phishing detection based on machine
learning and feature selection methods,” International
Journal of Interactive Mobile Technologies, vol. 13, no.
12, pp. 71–183, 2019, doi: 10.3991/ijim.v13i12.11411.

322
Authorized licensed use limited to: Zhejiang University. Downloaded on April 06,2025 at 14:23:02 UTC from IEEE Xplore. Restrictions apply.