Phishing websites detection via CNN and multi-head self-attention on imbalanced datasets

Xiao，Xi1,2; Xiao，Wentao1,2; Zhang，Dianyan1,2; Zhang，Bin2; Hu，Guangwu3; Li，Qing2,4; Xia，Shutao1,2

2021-09-01

10.1016/j.cose.2021.102372

COMPUTERS & SECURITY   影响因子和分区

0167-4048

1872-6208

Phishing websites belong to a social engineering attack where perpetrators fake legitimate websites to lure people to access so as to illegally acquire user's identity, password, privacy and even properties. This attack imposes a great threat to people and becomes more and more severe. In order to identify phishing websites, many proposals have shown their merits. For example, the classical proposal CNN-LSTM received a very high precision by combining Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) together. However, despite CNN achieved great success in AI area, LSTM still exists the biases issue since it always treats the later features much more important than the former ones. In the meanwhile, as the self-attention mechanism can discover the text's inner dependency relationships, it has been widely applied to various tasks of deep learning-based Natural Language Processing (NLP). If we treat a URL as a text string, this mechanism can learn comprehensive URL representations. In order to improve the accuracy for phishing websites detection further, in this paper, we propose a novel Convolutional Neural Network (CNN) with self-attention named self-attention CNN for phishing Uniform Resource Locators (URLs) identification. Specifically, self-attention CNN first leverages Generative Adversarial Network (GAN) to generate phishing URLs so as to balance the datasets of legitimate and phishing URLs. Then it utilizes CNN and multi-head self-attention to construct our new classifier which is comprised of four blocks, namely the input block, the attention block, the feature block and the output block. Finally, the trained classifier can give a high-accuracy result for an unknown website URL. Overall thorough experiments indicate that self-attention CNN achieves 95.6% accuracy, which outperforms CNN-LSTM, single CNN and single LSTM by 1.4%, 4.6% and 2.1% respectively.

Convolutional neural network Generative adversarial network Imbalanced dataset Multi-head self-attention Phishing websites detection

SCI ; EI

英语

其他

National Key Research and Development Program of China["2018YFB1800204","2018YFB1800601"] ; National Natural Science Foundation of China[61972219,61771273] ; Natural Science Foundation of Guangdong Province[2021A1515012640] ; R&D Program of Shenzhen["JCYJ20190813174403598","SGDX20190918101201696","JCYJ20190813165003837"]

Computer Science

Computer Science, Information Systems

WOS:000677639500010

ELSEVIER ADVANCED TECHNOLOGY

20212710578501

Computer crime ; Convolution ; Long short-term memory ; Natural language processing systems

Information Theory and Signal Processing:716.1 ; Data Processing and Image Processing:723.2

COMPUTER SCIENCE

2-s2.0-85108874331

Scopus

1.Shenzhen International Graduate School,Tsinghua University,China
2.Peng Cheng Laboratory,Shenzhen,China
3.School of Computer Science,Shenzhen Institute of Information Technology,Shenzhen,China
4.Southern University of Science and Technology,Shenzhen,China

Xiao，Xi,Xiao，Wentao,Zhang，Dianyan,et al. Phishing websites detection via CNN and multi-head self-attention on imbalanced datasets[J]. COMPUTERS & SECURITY,2021,108.

Xiao，Xi.,Xiao，Wentao.,Zhang，Dianyan.,Zhang，Bin.,Hu，Guangwu.,...&Xia，Shutao.(2021).Phishing websites detection via CNN and multi-head self-attention on imbalanced datasets.COMPUTERS & SECURITY,108.

Xiao，Xi,et al."Phishing websites detection via CNN and multi-head self-attention on imbalanced datasets".COMPUTERS & SECURITY 108(2021).