Robust Detection of Phishing URLs Under Obfuscation Attacks

Abstract

Purpose. Based on a dual-view approach, a lexical detection protocol for phishing web addresses was developed and experimentally validated under syntactic transformations that preserve the destination host within the adopted threat model.

Method. The study is empirical. An open dataset of phishing and legitimate web addresses compiled by Prasad and Chandra was used. After data cleaning, 235,366 unique records remained. The training, validation, and test subsets were partitioned by registrable domain. A character-level baseline model, a dual-view model, and the proposed model trained with data augmentation were compared. The threat model included host case variation, explicit default ports, percent encoding, fragments, trailing dots, user-info prefixes, removable path segments, and combinations of these transformations. Model performance was assessed using precision, recall, F1-score, area under the receiver operating characteristic curve (ROC-AUC), and false-positive rate.

Findings. On the clean, domain-disjoint test set, the baseline and augmentation-trained models achieved F1-scores of 0.9962 and 0.9960, respectively; under the baseline-adaptive transfer-testing scenario, the corresponding values were 0.9943 and 0.9961.

Theoretical implications. The study extends methodological approaches to evaluating lexical phishing detectors by substantiating the joint use of raw and canonical web address representations and invariance-oriented training within a formalized obfuscation-adversary model.

Practical implications. The proposed protocol is suitable for local pre-filtering of web addresses in email gateways, browser extensions, and monitoring systems without requiring network queries. It can also support security-policy decisions concerning web-address filtering.

Originality/value. The study demonstrates that performance on clean data alone is insufficient to substantiate claims of robustness within the adopted threat model. It further shows that training-time augmentation improves invariance to the studied class of semantically equivalent obfuscations without causing a practically significant degradation in performance on clean data.

Limitations/future research. Further temporal, cross-dataset, and browser-dependent evaluations are required before deployment in operational systems.

Paper type. Empirical.