Unbalanced Web Phishing Classification through Deep Reinforcement Learning

Abstract

Web phishing is a form of cybercrime aimed at tricking people into visiting malicious URLs to exfiltrate sensitive data. Since the structure of a malicious URL evolves over time, phishing detection mechanisms that can adapt to such variations are paramount. Furthermore, web phishing detection is an unbalanced classification task, as legitimate URLs outnumber malicious ones in real-life cases. Deep learning (DL) has emerged as a promising technique to minimize concept drift to enhance web phishing detection. Deep reinforcement learning (DRL) combines DL with reinforcement learning (RL); that is, a sequential decision-making paradigm in which the problem to be addressed is expressed as a Markov decision process (MDP). Recent studies have proposed an ad hoc MDP formulation to tackle unbalanced classification tasks called the imbalanced classification Markov decision process (ICMDP). In this paper, we exploit the ICMDP to present a double deep Q-Network (DDQN)-based classifier to address the unbalanced web phishing classification problem. The proposed algorithm is evaluated on a Mendeley web phishing dataset, from which three different data imbalance scenarios are generated. Despite a significant training time, it results in better geometric mean, index of balanced accuracy, F1 score, and area under the ROC curve than other DL-based classifiers combined with data-level sampling techniques in all test cases.

ELRL-MD: a deep learning approach for myocarditis diagnosis using cardiac magnetic resonance images with ensemble and reinforcement learning integration

“…Deep reinforcement learning (DRL) emerges as a viable solution by tackling these issues through a reward-based mechanism. Unlike conventional deep learning techniques that learn passively from a static dataset, DRL agents actively engage with their environment (Maci et al 2023). They make decisions that lead to feedback through rewards or penalties, facilitating a learning process that prioritizes long-term benefits and strategic adjustments.…”

A comprehensive investigation of clustering algorithms for User and Entity Behavior Analytics

“…As a subfield of AI, machine learning (ML) involves data-driven algorithms that support the decision-making process of SOC analysts in detecting network intrusions (Anumol, 2015 ). In the current literature, several research works propose innovative AI-based intrusion detection methodologies (Das et al, 2019 ; Singh A. et al, 2022 ; Alkhudaydi et al, 2023 ; Maci et al, 2023 , 2024 ; Park et al, 2023 ; Coscia et al, 2024 ). A SIEM can integrate these techniques to enhance real-time analysis capabilities (Muhammad et al, 2023 ).…”