Detection of Phishing Websites Using Supervised Learning

Abstract

Phishing attacks are becoming more common and sophisticated, putting Internet users at risk. Even though a broad range of countermeasures from academia, industry, and research have proved that these attacks are resilient, machine learning algorithms seem to be a feasible choice for distinguishing between phishing and genuine websites. Existing machine learning algorithms for phishing detection have three major drawbacks. Firstly, there is no methodology for extracting features and keeping the dataset current, nor an updated list of phishing and authentic websites. The second concern is the use of many features and the lack of evidence to justify the characteristics utilized in training the machine learning classifier. The last point of concern is the sort of datasets utilized in the research, which is skewed in terms of URL or content-based attributes. Fresh-Phish is an open-source and extensible system that extracts features and generates an up-to-date phishing dataset based on 29 distinct characteristics. The dataset includes 6,060 websites, 3,000 of which were malicious and 3,000 of which were legitimate. Therefore, 93 percent accuracy using six distinct classifiers is attained in this industry, which is a respectable maximum. To overcome the second and third difficulties, the domain name of phishing websites used to detect phishing. Based on a sample dataset, this learning model achieves 97% classification accuracy and 98% true positive rate using just 7 characteristics. This algorithm's resiliency is demonstrated. When these classifiers were tested on unidentified live phishing URLs, they detected 99.7% of them, exceeding the previous best of 95 percent.