Phishwiper: Automated Detection and Blocking of Phishing Websites

Phishing is defined as a cyber-attack which uses social engineering via digital means to persuade victims to disclose their personal information, such as their password or credit card number. In the end, the stolen personal information is used to defraud the trust of regular websites or financial institutions to obtain illegal benefits. Although different solutions have been exercised against phishing, phishing attacks have dramatically increased in the past few years. Some solutions are based on the features extracted by rules, and some of the features need to rely on third-party services, which will cause instability and time-consuming issues in the prediction service. This project proposes PhishWiper a deep learning framework that uses Predictive Attention Model with Recurrent Neural Network (RNN) to detect phishing links in a real-time web browsing environment using URL and HTML features. PhishWiper uses two separate deep networks, URLBlock and HTMLBlock, are separately trained and combined through a concatenation layer by eliminating the output layers of each to produce a final decision. This method examines the URL and HTML of webpages and computes their similarity with known phishing websites, in order to classify them. Phishing detection is a binary classification task that contains two classes: legitimate and phishing. We have implemented the framework as a browser plug-in capable of determining whether there is a phishing risk in real-time when the user visits a web page and gives a warning message. From the experimental results, it is observed that the proposed model achieved a significant performance when evaluated with different datasets with an accuracy of ranging from 96.79% to 98.90%.