Towards benchmark datasets for machine learning based website phishing detection: An experimental study

Hannousse, Abdelhakim; Yahiouche, Salima

doi:10.1016/j.engappai.2021.104347

Cited by 55 publications

(40 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most of the datasets are not suitable for replication studies because the URLs used to build the dataset (i.e., short-lived websites) cannot be accessed easily and many studies used self-collected datasets using different sources. To address this problem, recently Hannousse and Yahiouche [ 33 ] designed a construction scheme of reproducible datasets, which are also extensible. Their strategy creates a balanced datasets because many available datasets are imbalanced and it was reported that imbalanced datasets may reduce the performance between 5.9 and 42% in term of F1 score [ 21 ].…”

Section: Resultsmentioning

confidence: 99%

“…Their strategy creates a balanced datasets because many available datasets are imbalanced and it was reported that imbalanced datasets may reduce the performance between 5.9 and 42% in term of F1 score [ 21 ]. Hannousse and Yahiouche [ 33 ] created a sample dataset by using their set of guidelines to demonstrate the applicability of the approach and showed that Random Forest algorithm works best on this dataset, however, they did not apply deep learning algorithms and planned to analyze them in future work.…”

Section: Resultsmentioning

confidence: 99%

See 1 more Smart Citation

Applications of deep learning for phishing detection: a systematic literature review

Çatal

Giray²,

Tekinerdoğan

et al. 2022

Knowl Inf Syst

View full text Add to dashboard Cite

Phishing attacks aim to steal confidential information using sophisticated methods, techniques, and tools such as phishing through content injection, social engineering, online social networks, and mobile applications. To avoid and mitigate the risks of these attacks, several phishing detection approaches were developed, among which deep learning algorithms provided promising results. However, the results and the corresponding lessons learned are fragmented over many different studies and there is a lack of a systematic overview of the use of deep learning algorithms in phishing detection. Hence, we performed a systematic literature review (SLR) to identify, assess, and synthesize the results on deep learning approaches for phishing detection as reported by the selected scientific publications. We address nine research questions and provide an overview of how deep learning algorithms have been used for phishing detection from several aspects. In total, 43 journal articles were selected from electronic databases to derive the answers for the defined research questions. Our SLR study shows that except for one study, all the provided models applied supervised deep learning algorithms. The widely used data sources were URL-related data, third party information on the website, website content-related data, and email. The most used deep learning algorithms were deep neural networks (DNN), convolutional neural networks, and recurrent neural networks/long short-term memory networks. DNN and hybrid deep learning algorithms provided the best performance among other deep learning-based algorithms. 72% of the studies did not apply any feature selection algorithm to build the prediction model. PhishTank was the most used dataset among other datasets. While Keras and Tensorflow were the most preferred deep learning frameworks, 46% of the articles did not mention any framework. This study also highlights several challenges for phishing detection to pave the way for further research.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Resultsmentioning

confidence: 99%

Applications of deep learning for phishing detection: a systematic literature review

Çatal

Giray²,

Tekinerdoğan

et al. 2022

Knowl Inf Syst

View full text Add to dashboard Cite

show abstract

“…We agree that machine learning is a promising approach for the detection of cybersecurity attacks including XSS. However, three main obstacles hinder their usage in practice: lack of interpretability of their predictions, their susceptibility to adversarial attacks and lack of benchmarks [176,177]. The effective adoption of machine learning for cybersecurity attack detection requires to properly mitigate these three problems.…”

Section: Limitations Of Attack Detection Techniquesmentioning

confidence: 99%

“…Additionally, benchmarking is a long standing problem for machine learning based proposals. Benchmarks enable fair comparison of existing solutions and the development of more robust models [177]. In [133], the authors cooperate by proposing a new oversampling algorithm for XSS datasets.…”

Section: Limitations Of Attack Detection Techniquesmentioning

confidence: 99%

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

Hannousse¹,

Yahiouche²,

Nait-Hamoud³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

Cross-site scripting (XSS) is one of the major threats menacing the privacy of data and the navigation of trusted web applications. Since its reveal in late 1999 by Microsoft security engineers, several techniques have been developed in the aim to secure web navigation and protect web applications against XSS attacks. The problem became worse with the emergence of advanced web technologies such as Web services and APIs and new programming styles such as AJAX, CSS3 and HTML5. While new technologies enable complex interactions and data exchanges between clients and servers in the network, new programming styles introduce new and complicate injection flaws to web applications. XSS has been and still in the TOP 10 list of web vulnerabilities reported by the Open Web Applications Security Project (OWASP). Consequently, handling XSS attacks became one of the major concerns of several web security communities. In this paper, we contribute by conducting a systematic mapping and a comprehensive survey. We summarize and categorize existent endeavors that aim to protect against XSS attacks and develop XSS-free web applications. The present review covers 147 high quality published studies since 1999 including early publications of 2022. A comprehensive taxonomy is drawn out describing the different techniques used to prevent, detect, protect and defend against XSS attacks. Although the diversity of XSS attack types and the scripting languages that can be used to state them, the systematic mapping revealed a remarkable bias toward basic and JavaScript XSS attacks and a dearth of vulnerability repair mechanisms. The survey highlighted the limitations, discussed the potentials of existing XSS attack defense mechanisms and identified potential gaps.

show abstract

“…People's life has become more dependent on cyberspace, data on the cloud, social media networking, web transactions, e-healthcare, e-business, e-learning and education, and e-government services over the last decade, particularly during the coronavirus disease 2019 (COVID-19) epidemic [7]. Active cyber-space users have surpassed 4.66 billion (or 59.5% of the global population) through the channels and services as reported by World Digital Population Report 2021 [8]. Eventually, a lot of sensitive data has been transmitted and stored via cloud computing, which has given hackers many opportunities to impersonate trustworthy enterprises and services to intrude on computer-based systems and mobile platforms illegally using social engineering mimics [9].…”

Section: Introductionmentioning

confidence: 99%

Deep learning in phishing mitigation: a uniform resource locator-based predictive model

Salah

Zuhair

2023

IJECE

View full text Add to dashboard Cite

<span lang="EN-US">To mitigate the evolution of phish websites, various phishing prediction8 schemes are being optimized eventually. However, the optimized methods produce gratuitous performance overhead due to the limited exploration of advanced phishing cues. Thus, a phishing uniform resource locator-based predictive model is enhanced by this work to defeat this deficiency using deep learning algorithms. This model’s architecture encompasses pre-processing of the effective feature space that is made up of 60 mutual uniform resource locator (URL) phishing features, and a dual deep learning-based model of convolution neural network with bi-directional long short-term memory (CNN-BiLSTM). The proposed predictive model is trained and tested on a dataset of 14,000 phish URLs and 28,074 legitimate URLs. Experimentally, the performance outputs are remarked with a 0.01% false positive rate (FPR) and 99.27% testing accuracy.</span>

show abstract

Towards benchmark datasets for machine learning based website phishing detection: An experimental study

Cited by 55 publications

References 22 publications

Applications of deep learning for phishing detection: a systematic literature review

Applications of deep learning for phishing detection: a systematic literature review

Twenty-two years since revealing cross-site scripting attacks: a systematic mapping and a comprehensive survey

Deep learning in phishing mitigation: a uniform resource locator-based predictive model

Contact Info

Product

Resources

About