Phishing Website Detection as a Website Comparing Problem

Phishing attacks are severe threats to websites; therefore, phishing intelligence is crucial for web owners to prevent potential phishing campaigns. Intuitively, phishing websites must disguise themselves as genuine to trick users. Consequently, we can detect phishing websites based on the similarity between suspicious and original websites. Besides manual and community-based similarity checking services provided by third-party services, our work is focused on automating the phishing website detection process using machine learning approaches to better respond to phishing attacks. We have developed an automated system to actively search suspicious websites with phishing data from community-based phishing detection services. The system extracts and analyzes those websites’ screenshots and HTMLs, using a specialized image comparison module for screenshot and text vectorization. To quantify the similarities, the system then compares and calculates the distances between these features and those from the protected website. A machine learning model uses the similarities to conclude whether a suspicious website is a phishing site or not. We implemented and trained the model based on community-based services data. Our trained model successfully detected phishing and normal websites with almost-perfect accuracy in the experiments.