Phishing Web Page Classification Using Domain and Content Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting phishing web pages are inadequate, particularly for zero-day threats, as they rely heavily on monitoring encrypted network traffic and static block lists, which are ineffective against rapidly changing phishing domains.
Innovation Solution
A method utilizing machine learning models to analyze network, domain, and page content properties, including natural language processing and visual similarity, to classify web pages, enabling fast and accurate identification of phishing attempts even without full URL information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If monitoring and decryption of secure network traffic are used to discover phishing attacks, then detection capability is improved, but response time is too slow and zero-day threats cannot be detected
Solution Approach 1:
The system performs preliminary classification of web pages by analyzing domain properties, network attributes, and page content characteristics before actual phishing attacks occur. Machine learning models pre-process and evaluate multiple properties simultaneously, enabling near real-time detection of zero-day threats without waiting for traffic monitoring or decryption.
Solution Approach 2:
The detection system segments the web page analysis into multiple independent property evaluations: domain properties (age, registration date), network properties (IP address, hosting location), page content properties (text, images, forms), and visual properties. Each segment is classified separately by dedicated machine learning models, then combined for final phishing determination, enabling parallel processing and faster response.
2Device complexity
If static block lists are used for phishing detection, then implementation simplicity is improved, but adaptability to rapidly changing phishing domains deteriorates
Solution Approach 1:
The system transitions from static block lists to dynamic machine learning models that continuously adapt to new phishing threats. The models are trained on evolving datasets and automatically update their classification criteria based on new patterns, enabling the system to adapt to rapidly changing phishing domains while maintaining automated operation.
Solution Approach 2:
The detection system evaluates multiple dynamic parameters including domain age, registration date, IP address changes, hosting location, and page content characteristics. These parameters are continuously monitored and re-evaluated, allowing the system to detect new phishing attempts based on behavioral patterns rather than static domain blacklists.
3Measurement precision
If full URL information is required for phishing classification, then classification accuracy is improved, but processing speed and ability to classify without complete information deteriorates
Solution Approach 1:
The system performs phishing classification using only partial information - analyzing domain properties, network attributes, and page content characteristics without requiring the full URL. The machine learning models are trained to make accurate predictions from incomplete data, enabling fast classification even when full URL information is unavailable, while maintaining high detection accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and software can be used to determine a classification of a network accessible page, for example a web page on Internet. In some aspects, a method comprises receiving, at a gateway, a request for accessing a network accessible page from an end-user device; processing the network accessible page to generate a first embedding that characterizes network attributes of a domain of the network accessible page, and a second embedding that characterizes content attributes of the network accessible page; generating, from the first embedding, a first score that characterizes a predicted similarity between the network accessible page and one or more known network accessible pages; generating, from the second embedding, a second score that characterizes a predicted likelihood that the network accessible page is asking for sensitive information; and using at least the first score and the second score to determine a classification of the network accessible page.