Machine learning for tree structures in fake site detection

Introduction to Machine Learning with Applications in Information Security provides a class-tested introduction to a wide variety of machine learning algorithms, reinforced through realistic applications. The book is accessible and doesn’t prove theorems, or otherwise dwell on mathematical theory. The goal is to present topics at an intuitive level, with just enough detail to clarify the underlying concepts. The book covers core machine learning topics in-depth, including Hidden Markov Models, Principal Component Analysis, Support Vector Machines, and Clustering. It also includes coverage of Nearest Neighbors, Neural Networks, Boosting and AdaBoost, Random Forests, Linear Discriminant Analysis, Vector Quantization, Naive Bayes, Regression Analysis, Conditional Random Fields, and Data Analysis. Most of the examples in the book are drawn from the field of information security, with many of the machine learning applications specifically focused on malware. The applications presented are designed to demystify machine learning techniques by providing straightforward scenarios. Many of the exercises in this book require some programming, and basic computing concepts are assumed in a few of the application sections. However, anyone with a modest amount of programming experience should have no trouble with this aspect of the book. Instructor resources, including PowerPoint slides, lecture videos, and other relevant material are provided on an accompanying website: http://www.cs.sjsu.edu/~stamp/ML/. For the reader’s benefit, the figures in the book are also available in electronic form, and in color. About the Author Mark Stamp has been a Professor of Computer Science at San Jose State University since 2002. Prior to that, he worked at the National Security Agency (NSA) for seven years, and a Silicon Valley startup company for two years. He received his Ph.D. from Texas Tech University in 1992. His love affair with machine learning began in the early 1990s, when he was working at the NSA, and continues today at SJSU, where he has supervised vast numbers of master’s student projects, most of which involve a combination of information security and machine learning.

Phishing attacks are considered to be one of the most widespread cybersecurity threats, and attackers are becoming more successful by using advances in the field of artificial intelligence and natural language generation, in order to deceive consumers via email, SMS, and web. The existing rule-based and heuristic methods of detection cannot keep up with these dynamic and context-sensitive attacks, hence a high false-negative rate. The given work carries out a critical evaluation of the methods of artificial intelligence (AI), natural language processing (NLP)-based phishing detection, and concentrates on the deep learning, explainable artificial intelligence (XAI) methods. It was selected using IEEE Xplore, Scopus, Web of Science, ACM Digital Library, and ScienceDirect according to the PRISMA guidelines and 45 primary studies published between 2017 and 2025. This paper discusses preprocessing techniques, feature extraction techniques, machine learning, deep learning architectures, hybrid detection models, and explainability mechanisms of phishing detection. The findings indicate that hybrid systems incorporating convolutional neural networks, recurrent models, and transformer-based embeddings are able to perform better than traditional classifiers and are able to achieve over 95% accuracy when using various communication channels. Nevertheless, the majority of high-performing models remain opaque and, therefore, cannot be used in controlled cases. This research reveals the following gaps in research: poor cross-platform generalization, inadequate semantic resistance to paraphrased phishing messages, and a lack of explainability incorporation. The article gives a systematic overview of the current methodologies and gives future research directions in explainable, scalable, and adaptable phishing detection systems.

Phishing remains a significant cybersecurity threat, exploiting individuals and organizations by deceiving them into disclosing sensitive credentials such as usernames, passwords, and financial information. Attackers often use phishing URLs that mimic legitimate websites to lure victims into unknowingly submitting their private data. Given the increasing sophistication of these threats and the lack of cybersecurity awareness among users, it is crucial to develop robust detection mechanisms. This research introduces an ensemble machine learning model for phishing intrusion detection and URL classification, leveraging multiple classification algorithms to enhance accuracy and reliability. The proposed model analyzes key URL-based features to differentiate between legitimate and phishing URLs, providing an adaptive and intelligent detection system. By integrating multiple machine learning techniques, the ensemble approach improves detection rates while reducing false positives, ensuring a more effective defense against evolving phishing threats. The study aims to develop a client-side phishing detection tool that empowers internet users with realtime protection and assists cybersecurity professionals in identifying phishing patterns. The findings of this research contribute to advancing security measures for online users, mitigating the risks associated with phishing attacks, and fostering a safer digital ecosystem

Phishing websites are still a major threat in today's Internet ecosystem. Despite numerous previous efforts, similarity-based detection methods do not offer sufficient protection for the trusted websites, in particular against unseen phishing pages. This paper contributes VisualPhishNet, a new similarity-based phishing detection framework, based on a triplet Convolutional Neural Network (CNN). VisualPhishNet learns profiles for websites in order to detect phishing websites by a similarity metric that can generalize to pages with new visual appearances. We furthermore present VisualPhish, the largest dataset to date that facilitates visual phishing detection in an ecologically valid manner. We show that our method outperforms previous visual similarity phishing detection approaches by a large margin while being robust against a range of evasion attacks.

A phishing attack is a threat based on fraudulent communication, usually by e-mail, where the cybercriminals, impersonating a trusted person or organization, try to lure and coax a target. Phishing detection approaches that obtain highly representational features from the text of these e-mails are a suitable strategy to counter these threats since these features can be used to train machine learning algorithms, thus generating models able to classify mail samples as phishing or legitimate messages. This paper proposes a multi-stage approach to detect phishing e-mail attacks using natural language processing and machine learning. The proposed multi-stage approach consists of feature engineering within natural language processing, lemmatization, feature selection, feature extraction, improved learning techniques for resampling and cross-validation, and the configuration of hyperparameters. We present two methods of the proposed approach, the first one exploiting the Chi-Square statistics and the Mutual Information to improve the dimensionality reduction, while the second method associates Principal Component Analysis (PCA) and Latent Semantic Analysis (LSA). Both methods handle the problems of the “curse of dimensionality”, the sparsity, and the amount of information that must be obtained from the context in the Vector Space Model (VSM) representation. These methods yield reduced feature sets that, combined with the XGBoost and Random Forest machine learning algorithms, lead to an F1-measure of 100% success rate, for validation tests with the SpamAssassin Public Corpus and the Nazario Phishing Corpus datasets. Even considering just the text in e-mail bodies, the proposed multi-stage phishing detection approach outperforms state-of-the-art schemes for an accredited data set, requiring a much smaller number of features and presenting lower computational cost.

We present a circuit technique to extract true random numbers from carrier capture and emission in oxide traps in the emerging redox-based resistive memory (ReRAM). This phenomenon that appears as small changes in current magnitude passing through the device is known as random telegraph noise (RTN) and is increasingly becoming a source of reliability issues in nanometer-scale devices. We demonstrate a circuit that exploits TRN suitable for a true random number generator (TRNG) in security applications, where the system is secure from different adversarial attacks, including side-channel monitoring and machine learning analysis. We experimentally characterize RTN in ReRAMs and extract its dependency to temperature, voltage, and area. We introduce an RTN harvesting circuit to mitigate sensitivities to temperature fluctuations, injected supply noise, and power signal monitoring. We reduced bias and imbalance in data due to high-speed sampling via von Neumann whitening. The circuit is compared to conventional non-differential readout approach. Our approach shows a 7.26 times improvement in autocorrelation and significant resilience against the injected supply noise. We also demonstrate the TRNG’s quality and robustness using statistical tests and machine learning attacks. The output of the generator satisfies statistical tests for randomness and is immune to modeling attacks based on the machine learning methods.

Phishing websites are a problem for cybersecurity because they pretend to be real online services to get sensitive information from users like login details and financial information. The people who make these phishing websites can. Shut them down quickly which makes it hard for traditional methods to detect them. To solve this problem this paper talks about a system that uses machine learning to detect phishing websites by looking at the website address and domain. This way the system can detect phishing websites without having to look at the webpage. The system uses a set of data with 11,055 website addresses and 31 special features to test how well it works. These features look at things like the structure of the website address, who registered the domain and things that might indicate phishing. The system uses two kinds of classifiers Logistic Regression and Random Forest to test how well it can detect phishing websites. The system also uses an ensemble model that combines the results from both classifiers to make the predictions more reliable. The results show that thisensemble model is really good at detecting phishing websites and can balance being precise and catching all the phishing websites. The system is also good at telling the difference between fake websites. The people who made the system also created a user interface that can analyze website addresses in time which makes it more useful and practical. The system is a solution for detecting phishing websites in the real world and can be used in many different situations. Phishing websites are a problem but this system can help solve it. The system uses machine learning and a special ensemble model to detect phishing websites. It is really good, at it. Phishing websites will continue to be a problem. With this system we can detect them more easily. Keywords: Phishing Website Detection, Machine Learning, URL-Based Feature Extraction, Cybersecurity, URL Classification, Random Forest Classifier, Logistic Regression, XGBoost Algorithm, Fusion Model, Soft Voting Ensemble, Attack Type Identification, Credential Phishing, Financial Fraud Detection, ROC Curve Analysis, AUC PerformanceMetric

Detecting phishing websites is a rapidly evolving field aimed at identifying and mitigating cyberattacks targeting individuals, organizations, and governments. Ongoing progress in artificial intelligence (AI) has the potential to revolutionize phishing detection by enhancing model accuracy and improving transparency through eXplainable AI (XAI). However, significant challenges remain, particularly in integrating feature engineering with XAI to address sophisticated phishing strategies including zero-day attacks, that evade traditional detection mechanisms. To overcome these challenges, this examines the impact of feature engineering and XAI in phishing detection, emphasizing their ability to enhance accuracy while providing interpretability. By integrating feature extraction with interpretable models, these techniques improve decision-making transparency and system robustness. This paper presents the first systematic literature review (SLR) focusing on the impact of feature engineering and XAI on state-of-the-art phishing detection approaches. Additionally, it identifies critical research gaps and challenges, including scalability issues, the evolution of phishing techniques, and balancing complexity with interpretability. The findings provide valuable academic insights while offering practical recommendations for developing accurate and interpretable phishing detection systems, aiding organizations in strengthening cybersecurity measures.

A phishing attack is one of the most common forms of cybercrime worldwide. In recent years, phishing attacks have continued to escalate in severity, frequency and impact. Globally, the attacks cause billions of dollars of losses each year. Cybercriminals use phishing for various illicit activities such as personal identity theft and fraud, and to perpetrate sophisticated corporate-level attacks against financial institutions, healthcare providers, government agencies and businesses. Several solutions using various methodologies have been proposed in the literature to counter web-phishing threats. This research work adopts a novel strategy to the detection and prevention of website phishing attacks, with a practical implementation through development towards a browser toolbar add-in. The IPDS is shown to be highly effective both in the detection of phishing attacks and in the identification of fake websites. Experimental results show that approach using the CNN + LSTM has a 93.28% accuracy with an average detection time of 25 seconds, whilst the approach has a slightly lower accuracy. These times are within typical times for loading a web page which makes toolbar integration into a browser a practical option for website phishing detection in real time. The results of this development are compared with previous work and demonstrate both better or similar detection performance. This is the first work that considers how best to integrate images, text and frames in a hybrid feature-based solution for a phishing detection scheme.

This study aimed to develop a robust machine learning-based phishing detection system using algorithms such as K-nearest neighbour (KNN), artificial neural network (ANN), and random forest (RF). It utilised datasets from Ariyadasa et al. (2021) and UNB (2016) to discern patterns distinguishing legitimate from phishing websites. Furthermore, an objective was to integrate the optimal model into a Django-based web application, facilitating real-time phishing detection. A comprehensive literature review on phishing detection techniques was also undertaken. Datasets chosen underwent rigorous pre-processing to address missing values and imbalance. Feature selection was achieved manually and automatically using mutual information classification. Three machine learning algorithms, RF, KNN, and ANN, were explored. Their hyper-parameters were optimised using GridSearchCV. Performance results highlighted RF's accuracy at 99.78%, KNN's at 99.67%, and ANN's at 99.11%. While RF and KNN models perfectly identified legitimate websites, ANN showcased an impeccable detection of phishing websites. The RF model, with the highest accuracy, was integrated into a Django application, providing a user interface for real-time phishing detection. All models exhibited high accuracy rates, demonstrating their efficacy in phishing detection. While RF was integrated into the web application for this study, the choice between models depends on specific user or business requirements and priorities. Feedback mechanisms within the Django application further promise refinement in future recommendations. The study provides a foundational step toward enhancing web safety through effective phishing detection.

During the last decade, the cybersecurity literature has conferred a high-level role to machine learning as a powerful security paradigm to recognise malicious software in modern anti-malware systems. However, a non-negligible limitation of machine learning methods used to train decision models is that adversarial attacks can easily fool them. Adversarial attacks are attack samples produced by carefully manipulating the samples at the test time to violate the model integrity by causing detection mistakes. In this paper, we analyse the performance of five realistic target-based adversarial attacks, namely Extend, Full DOS, Shift, FGSM padding + slack and GAMMA, against two machine learning models, namely MalConv and LGBM, learned to recognise Windows Portable Executable (PE) malware files. Specifically, MalConv is a Convolutional Neural Network (CNN) model learned from the raw bytes of Windows PE files. LGBM is a Gradient-Boosted Decision Tree model that is learned from features extracted through the static analysis of Windows PE files. Notably, the attack methods and machine learning models considered in this study are state-of-the-art methods broadly used in the machine learning literature for Windows PE malware detection tasks. In addition, we explore the effect of accounting for adversarial attacks on securing machine learning models through the adversarial training strategy. Therefore, the main contributions of this article are as follows: (1) We extend existing machine learning studies that commonly consider small datasets to explore the evasion ability of state-of-the-art Windows PE attack methods by increasing the size of the evaluation dataset. (2) To the best of our knowledge, we are the first to carry out an exploratory study to explain how the considered adversarial attack methods change Windows PE malware to fool an effective decision model. (3) We explore the performance of the adversarial training strategy as a means to secure effective decision models against adversarial Windows PE malware files generated with the considered attack methods. Hence, the study explains how GAMMA can actually be considered the most effective evasion method for the performed comparative analysis. On the other hand, the study shows that the adversarial training strategy can actually help in recognising adversarial PE malware generated with GAMMA by also explaining how it changes model decisions.

FAQ (frequently asked questions) is the basis of question answering system (QA) that oriented frequently asked questions database. For the FAQ is difficult to collect and organize, this paper proposed an automatic acquisition method of domain FAQ based on improved Bayes. Parsing HTML pages into DOM tree, combining with the restricted domain knowledge base, extracting the node information and structural characteristics of DOM tree as the classified feature, using the improved Bayesian classified learning algorithm, constructing the classification model, acquiring FAQ from the HTML page automatically and filtering out the domain FAQ , the experimental results of this method show that it has a remarkable effect.

Rapid growth in technology has opened up wide means of communication. Electronic mail was a great contribution in the field of communication. Emails played the role of a valuable communication medium for all the internet users in the world. Phishing emails are spreading like an infectious disease nowadays. It results in economic losses and wastage of time of email users. Different kinds of phishing emails have been reported for this time. Many approaches have been developed in order to counteract this problem. In this paper, a model for phishing detection, which is based on the combination of linguistic techniques along with the machine learning technique is proposed. This paper also presents an overview of the main approaches developed with the aim of detecting and thereby filtering phishing emails and this work is done with the aid of a wide range of papers published in this field. Keywords: Anti-phishing; Client side defenses; Machine Learning; Phishing; Server side defenses.

Phishing is a significant threat in cyberspace that causes losses in businesses and for individuals, in which phishing attacks use social engineering methods, such as emails as well as SMS, to disguise prohibited URLs as legitimate ones to steal users’ confidential information. As a result, the loss caused by these attacks calls for an effective process for preventing phishing attacks. Consequently, to reduce the threat posed by phishing emails, which have been increasing at an alarming rate in recent years, more effective phishing detection is required to improve the classification performance. In this research, a Deep Learning (DL)-enabled model is invented for phishing detection. The most imperative purpose of the current research is to create a detection as well as a mitigation model for phishing detection in web pages using an incremental Learning based Attention Ensemble Long-Short-Term Memory (LSTM) based on optimization. The proposed fractional hand wing optimization (HaWO) focuses on adjusting the hyperparameters of LSTM, which is crucial to understanding the significance of this research. Incorporating Adaptive incremental learning enables the model to update its parameters incrementally, with dynamic changes in the data. In addition, utilizing the channel and positional attention with the ensemble LSTM boosts the model’s capacity to fully exploit the pertinent features during training, which results in accurate findings of phishing emails. DL is also used in the mitigation module to add the attacker to the black–list as well as halt further communication from phishing websites. The proposed phishing detection model achieves accuracy, sensitivity, specificity, and [Formula: see text]1-score values of 97.40%, 96.60%, 98.21%, and 95.90%, respectively, for 80% of training. Specifically, the developed model achieves the metric values of 96.90%, 96.46%, 97.36%, and 95.41%, respectively, for the 8 [Formula: see text]-fold validation.

Phishing detection with high-performance accuracy and low computational complexity has always been a topic of great interest. New technologies have been developed to improve the phishing detection rate and reduce computational constraints in recent years. However, one solution is insufficient to address all problems caused by attackers in cyberspace. Therefore, the primary objective of this paper is to analyze the performance of various deep learning algorithms in detecting phishing activities. This analysis will help organizations or individuals select and adopt the proper solution according to their technological needs and specific applications’ requirements to fight against phishing attacks. In this regard, an empirical study was conducted using four different deep learning algorithms, including deep neural network (DNN), convolutional neural network (CNN), Long Short-Term Memory (LSTM), and gated recurrent unit (GRU). To analyze the behaviors of these deep learning architectures, extensive experiments were carried out to examine the impact of parameter tuning on the performance accuracy of the deep learning models. In addition, various performance metrics were measured to evaluate the effectiveness and feasibility of DL models in detecting phishing activities. The results obtained from the experiments showed that no single DL algorithm achieved the best measures across all performance metrics. The empirical findings from this paper also manifest several issues and suggest future research directions related to deep learning in the phishing detection domain.