DEIM Forum 2019 G2-3

A Survey of URL-based Phishing Detection
Eint Sandi Aung†a)Chaw Thet Zan†b)

andHayato YAMANA†c)Department of Computer Science and Communication Engineering, Graduate School of Fundamental Science andEngineering, Waseda University, Tokyo, 159-8555, Japan.
E-mail : a) eintsandiaung@toki.waseda.jp, b) chawthetzan@fuji.waseda.jp, c) yamana@waseda.jp
Abstract Cyber phishing is regarded as a theft of personal information in which phishers, also known as attackers, lure users
to surrender sensitive data such as credentials, credit card and bank account information, financial details, and other behavioral
data. Phishing detection is becoming a crucial research area, attracting increased focus as the number of phishing attacks grows.
Furthermore, because attackers are innovating various techniques, detection has become a primary concern of developers. A
number of phishing detection schemes has been built into their architecture, such as whitelist-, blacklist-, content, visual
similarity and URL-based in general. Each has its individual advantages and drawbacks. In this survey paper, we emphasize on
URL-based phishing detection techniques, because we consider the URL to be a significant criterium in preventing phishingattacks. Moreover, examining URL-based features can also encourage faster processing than other approaches. In this work, we
aim to understand the structure of URL-based features and surveying their diverse detection techniques and mechanisms. We
then analyze the performance based on the combinations of URL features on different datasets. Finally, we summarize ourfindings to promote better URL-based phishing detection systems.
Keyword Phishing, URL-based, Web Security, Features

1. Introduction

detection via web server log referrer field monitoring,”

Phishing is a cyber threat in which attackers take advantage

said Stefanie Ellis, Anti-Fraud Product Marketing Manager

of users by mimicking legitimate authentic, websites in

at MarkMonitor [50].

order to steal sensitive information such as passwords andFurthermore, half of the phishing sites are currently usingbank statements. Phishing is performed through different

HTTPS and SSL certificates to confuse users. PhishLabs–

mediums: internet, short message service and voice. Theirantargeted vectors can be email, instant messaging, smishing

cyberattacks, reported that half of all phishing sites are(short message phishing), vishing (voice phishing) andusing SSL encryption to deceive users with the familiar

websites [1]. In this paper, phishing refers to web phishinggreen lock symbol while some phishers even add HTTP

through the Internet. Although phishing can be protectedencryption.

against by: (1) user awareness, and (2) technology-based

These occurrences illustrate that phishers have anapproaches, the former cannot be completely trusted sinceincreasing preference for URL-based attacks to gather

it relies on humans–not all of whom are aware of phishing.

sensitive information. Therefore, we emphasize URL-

Thus, our survey focuses on the latter for phishingbased phishing detection in our survey. Moreover, URL-

detection.

based

According to the Anti Phishing Working Group (APWG)

processing time compared to other approaches such as

3 rd Quarter, 2018 report [2], the total number of detectedblacklist, content and visual similarity.

APWG

memberphishing

that

detection

providescanservices

againstreduce workload

andphishing attacks was 151,014. Although this number

In this work, we survey different techniques for URL-

reported has reportedly dropped since 2 nd Quarter, 2018, it

based phishing detection. The objective of this paper is to

is still significant statistic for the public to be aware of.

summarize our systematic analysis of phishing detection

According to the report, there was an increase in the use of

based on URLs’ characteristics–which, we believe, have a

web page redirects for hiding phishing sites. As the number

significant effect on the detection.

of page redirects used by phishers is enormously increasing,This paper is organized as follows: Section 2 presents a

more users are lured to actual phishing sites. When users

review of the literature related to phishing and its various

click on phishing links, they are being taken to phishingdetection categories. Section 3 consists of the architecturesites via other sites, where their credential information isof URL-based phishing and a survey of the diverse features,requested.

“This obfuscation technique is an effort by thedatasets nature, methods, and evaluation metrics. Section

phishers to hide the phishing URL – most notably from4 provides a summary and our opinions on existing1

techniques. Section 5 presents the conclusion followed byretrieval algorithm used to detect phishing websites.

references.

CANTINA alone resulted in a high false positive rate due

2. Literature Review

to limitations on the number of search engine results. This

Just as phishing has various unique characteristics, so domeans that as they increase the number of results, false

the detection techniques and methods. However, phishingpositive rate will decrease while true positive rate remains

approaches can generally be classified into five categories:

the same, which is not optimal. Thus, they used several

whitelist-, blacklist-, content-, visual similarity- and URL-

heuristics to reduce the false positive rate and improvebased. We list an overview of each approach for a better

accuracy. Their approach achieved a better outcome

understanding as follows:

compared to popular anti-phishing toolbars, achieving 97%

2.1. Whitelist-Based Approachtrue positive and 1% false positive rate. In 2011, Xiang etKang et al. [3] proposed an approach based on white-listedal. [7] further improved CANTINA, calling it CANTINA + ,sites in 2007. They performed a URL similarity check towhich is regarded as the most comprehensive feature-rich

distinguish phishing sites from otherwise and a mechanism

approach in content-based phishing detection. It achieved

comparing with Domain Name System (DNS) query toa better 0.4% false positive rate and over 92% true positive

overcome DNS pharming attacks– problem for relying on

rate. However, since both approaches use search engines

DNS from previous researches. In 2008, Cao et al. [4] also

and third-party services, DNS compromising became apresented an automated individual white-list approach, inchallenging threat. Similar works can be found inwhich the system maintains a user’s previous login and[23][24][25].

warns when unfamiliar access has occurred. Although

2.4. Visual-Similarity-Based Approach

whitelist-based methods seem effective for phishing

Wenyin et al. [8] proposed a simple visual-similarity-based

detection, there is a limitation on getting legitimate sites

approach in 2005. Their system performed phishing

all on the web. An abundant list of reliable websites is

detection on three levels of similarity matrices; (i) block-necessary for a robust system with high accuracy;

level similarity, (ii) layout-similarity and (iii) overall-styleotherwise, false positive rates increase due to a lack ofsimilarity. However, the most representative work on

white-listed websites information, which is practicallyvisual similarity was later presented by Fu et al. [9] in 2006

impossible to collect all legitimate sites in the world.

using the Earth Mover Distance (EMD). EMD was used to

2.2. Blacklist-Based Approachcalculate the signatures of two images for visual similarity.

Web browsers–such as Google Safe Browsing – that defend

Although their method performed well in accuracy withagainst phishing attacks by updating a list of black-listed

89% true positive and 0.71% false positive rates, thesites. In 2008, Sharifi et al. [5] proposed a new black-ist

significant workload required to process two images was agenerator technique to solve the common issues of

performance drawback, compared to other approaches.

maintaining an up-to-date list. However, since their

Chen et al. [16] introduced a heuristic anti-phishingproposed system relies on third-party services (likesystem to model perceptual similarity. They employed a

Google) for searching domain name to compare top results,

logistic regression algorithm for normalizing page content

it results in poor performance. Furthermore, blacklist

features. Although the proposed method achieved 100%

approaches encounter the major issue of zero-hour

true positive rate, it had 0.74% false positive rate, whichphishing attacks because newly created phishing sites are

could be improved. There are many similar works based on

not in the list. PhishNet [22] also predicts phishing attacks

visual similarity including [27] [28] [29] [30] [31] [32]based on a blacklist scheme. It uses five heuristics–top-[33] [34] [35] [36] [37].

level domain, IP address, directory structure, query string

2.5. URL-Based Approachand brand name–for combinations of blacklists to predict

M. Aburrous, M. A. Hossain, K. Dahal and F. Thabtah [10]new phishing sites. Although it cannot detect zero-hour

proposed and intelligent phishing detection system for e-phishing sites, it achieves 95% true positive rate and 3%

banking using fuzzy data mining in 2010. The experiment

false positive rate over large datasets.

was performed based on fuzzy logic with data mining

2.3. Content-Based Approachalgorithms.

They

showedhoweffective

URL-based

Zhang et al. [6] presented a novel approach, so-called

approaches are for phishing detection. Overall, URL-based

CANTINA in 2007. Their work is based on Term Frequency

methods perform faster than any other, including content-- Inverse Document Frequency (TF-IDF) informationand visual-similarity based approaches. More importantly,

2

Type 5they work well on zero-hour phishing attacks, which are

http://goo.gl/HQx5g

becoming a major concern in modern anti-phishing society.

3.2. URL-Based Detection Schemes

In upcoming sections, we further discuss details of URL-

Previous research has primarily focused on two detection

based detection. Similar works can be found in [18] [19].

schemes as:

2.6. Other Approaches•

Algorithms-based (Feature Extraction + Classification)•

FeatureA variety of alternative techniques are used by researchersinphishing

detection.

Suchtechniques

includeEngineering-based(Feature

Extraction+

Feature Selection + Classification)

heuristic[17], hybrid[13], machine-learning[20], DNS-

We discuss these schemes in the following sections.

based and others [21][26]. Additionally, several surveys

3.2.1. Commonly Used Algorithms

regarding different schemes are performed by researchers

Here, we list the machine learning algorithms most[11][12][15][16].

commonly used in phishing detection literature.

3. Architecture of URL-Based Phishing
URL-based phishing attacks are mainly performed by

3.2.1.1. Naïve BayesNaïve Bayes (NB) is a simple, yet effective classifier used

embedding sensitive words or characters in a link that:in numerous applications. In a NB classifier, x is the

1. Mimic similar but misspelling words.

features vectors, y Î {0,1} is a label representing either a

2. Contain special characters for redirecting.

phishing or legitimate website (y = 1 for phishing and y =3. Use shortened URLs.

0 for legitimate), and P (x|y) is the conditional probability

4. Use sensitive keywords which seem reliable.

of the feature vector given its label. Assuming phishing and

5. Add a malicious file in the link and so on.

legitimate websites are equally probable, the posterior

Figure 1 shows how URL phishing is performed. When

probability of x belongs to y=1 is as follows:

phishers mimic as reliable sites, users submit credential!(# = 1|') = ).'/# = 101)(*|+,2)

information to attackers without knowing the website is)(*|+,-)(1)

3.2.1.2. Support Vector Machine

faked.

Support Vector Machine (SVM) is a typical machinelearning method for classification and regression. SVM
finds the optimal separating hyperplane between two labels.
It can be expressed by the kernel function K(x,x¢), in which
the similarity of two feature vectors is computed, and nonnegative coefficients µ3 . SVM indicates which training
Fig 1. Architecture of URL phishing

3.1. URL Types
According to PhishStorm [11], five different types of URL
obfuscation are employed. URLs are obfuscated by mixing
keywords in paths, queries and low-level domains asfollows listed with examples in Table 1:
Type 1: Obfuscation with other domains
Type 2: Obfuscation with keywords
Type 3: Typo-squatting domains
Type 4: Obfuscation with IP address
Type 5: Obfuscation with URL shorteners
Type
Type 1
Type 2Type 3
Type 4

Table 1. URL Obfuscation Types
Samplehttp://school497.ru/222/www.paypal.
com/29370274276105805
http://quadrodeofertas.com.br/www1.
paypal-com/encrypted/ssl218
http://cgi-3.paypalsecure.de/info2/verikerdit.html
http://69.72.130.98/javaseva/https://paypal.com/uk/onepagepaypal.htm

examples lie closely to the decision boundary. It classifies
data by computing distance to decision boundary.
ℎ(') = ∑8- µ3 (2#3 − 1) 9('3 , ')(2)

3.2.1.3. Random Forest
A Random Forests is built with random attribute selection
using bagging. Random Forests employ a divide andconquer approach (ensemble mechanism) for improving
performance. In a random forest, the mechanism combines
various random subsets of trees. The overall result is
calculated based on the average, or weighted average, of
the individual results. The accuracy depends on a measureof the dependence between the classifier and the strengthof the individual classifiers and they improve the problemof overfitting of the decision trees.
3.2.1.4. Convolutional Neural Network
Convolutional Neural Network (CNN) is a category of deepneural networks used to analyze image processing. CNN
requires relatively little pre-processing compared toother image classification algorithms. It learns features3

themselves

–

a

major

advantageinfeatureengineering, which is different from other classifications
pre-specifiedbyresearchersintraditional

phishing

detection. As it is mostly designed for image classification,
it is performed on character-level embeddings for phishingdetection. CNN networks contain a convolution layer,
pooling layer and fully connected network with non-linear
activation function. Table 2 lists several algorithms
commonly used in the phishing detection field.
No
1
2
3
4
5
6
7
8

Table 2. Commonly Used Algorithms
Algorithms
ReferencesNaïve Bayes[39][41][43]Logistic[39][43][48]Regression
Random Forest[14][39][40][43][47][48]Support Vector[39][41][43][44]Machinek-means[44]
Neural Network[38][39][45][46]
LSTM[40][44][45][46]
Decision Tree[47][48]

16

Shorten URL

URL using entropy
Check if URL
shortenedis3.3. Evaluation Matrices
Here, we assume that N represents the number oflegitimate/phishing websites and P represents phishing andL represents legitimate.
True Positive rate (TPR): the ratio of the number ofcorrectly classified phishing attacks ( <)→) ) to the total
number of phishing attacks (<)→) + <)→? ). See Equation(3) for details.
False Positive rate (FPR): the ratio of the number oflegitimate sites that are incorrectly detected as phishingattacks (<?→) ) to the total number of all existing legitimate
sites (<?→? + <?→) ). See Equation (4) for details.
True Negative rate (TNR): the ratio of the number ofcorrectly classified legitimate sites ( <?→? ) to the total
number of existing legitimate sites ( <?→? + <?→) ). See
Equation (5) for details.

3.2.2. Common URL-Based Features

False Negative rate (FNR): the ratio of the number ofIn the feature engineering field of phishing detection,

phishing attacks that are incorrectly classified as legitimate

researchers apply several features depending on their( <)→? ) to the total number of phishing attacks ( <)→) +detection techniques. We survey the more commonly used<)→? ). See Equation (6) for details.

features in URL-based detection in Table 3.

Precision (P): the ratio of correctly detected phishing

Table 3. Common URL-Based Features
No Feature Name
Description
1
IP address
Check if IP address ispresented in existingdomains2
Avg. words length Count average lengthof meaningful words inentire domain name3
exe/zip
Check if exe/zip ispresent in URL
4
No of dots
Count # of dots in URL
5Special symbols
Count special symbols
in URL6
URL length
Count # of charactersin URL7
Top-level domain Validate
TLD-based(TLD) featurefeatures [39][40][44]8“http” countCount # of “http” inURL
9Brand name
Extract brand name in
URL domain
10 “//” redirection
Check
if
“//”
is
included in URL path11
Domain separated Check
if
“-“
is
by “-“included in domain
name12 Multi-sub domain
Check how many # of
multi-subdomains areincluded in URL
13 Suspicious words
Check if suspicious
words are included in
URL
14 Digits in domain# of digits in domain
15 Character entropy
Calculatecharacter
distribution in entire

attacks (<)→) ) to the total number of attacks detected asphishing (<?→) + <)→) ). See Equation (7).
Recall (R): equivalent to TP rate. See Equation (8).
Accuracy (ACC): the ratio of the sum of correctlyclassified phishing and legitimate sites ( <?→? + <)→) ) to
the total sites (<?→? + <?→) + <)→) + <)→? ). See Equation(9) in details.
@!A = B

BC→C

E!A = B

BD→C

@<A =

BD→D

C→C 1BC→D

D→D 1BD→C

BD→D 1BD→C
BC→D

E<A =
!=B

BC→C 1BC→D
BC→CD→C 1BC→C

A = @!

(3)
(4)
(5)
(6)
(7)
(8)

FGG = B

BD→D 1BC→CD→D 1BD→C 1BC→C 1BC→D(9)

We surveyed and listed URL-based phishing detection
mechanisms. Table 4 describes the comparative evaluation
results based on the above matrices.

3.4. Datasets Nature
Researchers collect data sources from popular websites

4such as Alexa and DMOZ for legitimate, and PhishTank andliterature on overall phishing detection schemes. Second,

OpenPhish for phishing. Several common sources are listed

we discussed the architecture of URL-based phishing, andin Table 5.

commonly used algorithms and features. Third, common

Table 5.Data Sources
Data Source
digg58.com, Alexa, DMOZ, payment
gateway, Top banking website
Phishing
PhishTank, OpenPhish, VirusTotal,
MalewareDomainList,
MalewareDomains, jwSpamSpy
We discover that a majority of the researches focuses ondata sources were listed,

Type
Legitimate

imbalanced data as the number of phishing sites cannot becompared with that of legitimate sites. However, several
studies use balanced datasets to avoid dataset bias.

4. Summary and Opinion
In our survey perspective, we observed two perspectives
from the existing detection schemes; (i) dataset perspective,and (ii) feature perspective.
From the dataset perspective, researchers primarily
analyze the detection method on imbalanced data, in which
the majority class is legitimate sites. This results in abiasing majority class. Put differently, the result is biased
although it has a high false positive rate. To address this,oversampling on minority data becomes effective since itbalances data size by realistic automated minority-classdata.
From the feature perspective, we find that several URLbased features–such as the number of subdomains and URL
length could also be biased since they highly rely on thedataset. In other words, many researchers use Alexa.com
for legitimate dataset, in which only index pages of highly
ranked websites are provided. However, phishing datasetsfrom PhishTank.com or OpenPhish.com list the entire
URLs of the phishing webpages in which phishers use freehosting services that are highly ranked in Alexa. Thus, as
for the number of subdomains, legitimate sites from
Alexa.com will not have any, while phishing sites will.
Furthermore, phishers have complete control over URL
composition except for the domain name. Features like
URL length

can

be

easilymanipulated.

Therefore,

researchers have recently targeted domain name-based
features–instead of entire URL–to extract characteristics ofdomain name and current page content.

5. Conclusion
In this paper, we described our systematic survey ofexisting URL-based phishing detection techniques fromdifferent views. Although previous survey papers exist,
theygenerally

focus

on

overallphishing

detectiontechniques, while we focused on detailed URL-based
detection with respect to features. Firstly, we reviewed theand comparative evaluation

results and matrices were shown for better survey. Finally,
we concluded with our recommendations for more effective
phishing detection in the future.

References[1] K. L. Chiew, K. S. C. Yong, C. L. Tan, “A survey ofphishing attacks: their types, vectors and technicalapproaches,” in Expert Systems with Applications,vol.106, pp.1-20, 2018.
[2] I. Tanaka and J. Suzuki, “Web and Database
Technologies”, Proc. of ACM SIGMOD, pp. 10-22,
201 APWG, “Phishing activity trends report, 3 rdQuarter2018,”Internet:http://docs.apwg.org/reports/a
pwg_trends_report_q3_2018.pdf, Dec. 12, 2018 [Dec.
25, 2018][3] J. Kang and D. Lee, “Advanced white list approachfor preventing access to phishing sites,” Proc.
International Conference on Convergence Information
Technology (ICCIT 2007), pp.491-496, 2007.
[4] Y. Cao, W. Han, and Y. Le, “Anti-phishing based on
automated individual white-list,” Proc. the 4 th ACM
Workshop on Digital Identity Management, pp.51–60,
2008.
[5] M. Sharifi and S. H. Siadati, “A phishing sites
blacklist generator,” in IEEE/ACS International
Conference on Computer Systems and Applications,pp. 840-843, 2008.
[6] Y. Zhang, J. I. Hong, L. F. Cranor, “Cantina: acontent-based approach to detecting phishing websites,” Proc. the 16 th International Conference on
World Wide Web, pp.639-648, 2007.
[7] G. Xiang, J. Hong, C. P. Rose, L. Cranor, “Cantina+:
a feature-rich machine learning framework or
detecting phishing web sites,” in ACM Transactions
on Information and System Security (TISSEC), vol.14,
no.2, pp.21:1-21:28, 2011.
[8] L. Wenyin, G. Huang, L. Xiao Yue, Z. Min, X. Deng,“Detection of phishing webpages based on visual
similarity,” in Special interest tracks and posters of
the 14th International Conference on World Wide Web,
pp. 1060-1061, 2005.
[9] Y. Fu, L. Wenyin and X. Deng, "Detecting phishing
web pages with visual similarity assessment based onearth mover's distance (EMD)," in IEEE Transactions
on Dependable and Secure Computing, vol. 3, no. 4,
pp. 301-311, 2006.
[10] M. Aburrous, M. A. Hossain, K. Dahal, F. Thabtah,“Intelligent phishing detection system for e-banking
using fuzzy data mining,” in Journal of Expert Systemwith Applications, vol.37, no.12, pp.7913-7921, 2010.
[11] S. Marchal, J. Francois, R. State, T. Engel,“PhishStorm: detecting phishing with streaming
analytics,” in IEEE Transactions on Network andService Management, vol.11, no.4, pp.458-471, 2014.
[12] M. Khonji, Y. Iraqi, A. Jones, “Phishing detection: aliterature survey,” in IEEE Communications Surveys& Tutorials, vol.15, no.4, pp.2091-2021, 2013.
[13] M. Dadkhah, S. Shamshirband, A. Wahab, “A hybrid
approach for phishing web site detection,” in the5Table 4. Comparison of Evaluation Results in Existing Phishing Detection
Paper

Performance
Acc
TP

FP

Prec

Rec

F1
Score

[38]
[39]

99.09

[40]

98.76

[41]

95.80

[42]

95.00

[43]

[44]

98.60

98.93

98.76

AUC

Data Set
Dataset source

99.29

Legitimate
VirusTotal

Phishing
VirusTotal

Legitimate
16M

Phishing
0.9M

Alexa+
Payment
Gateway+
Top Banking
WebsiteCommonCrawl

PhishTank+
OpenPhish

1600+
66+
252

1528+
613

PhishTank

1M

1M

Balanced

Alexa+
SearchEnginePhishTank

500+
500

1000

Balanced

99.91

Dataset size

Imbalanced

PhishTank

99.70

0.40

99.70

99.70

99.70

URL Features

Algorithms

Year

Primary domain feature,path feature, file extension
feature (*3)
No. of dots, Special
symbols, URL length,
special words, position ofTLD, HTTP count, brand
name, data URI (*8)
Path length, URL entropy,
length ratio, ’@’ and ’-’count, punctuation count,
TLDs count, IP address,
suspicious words count,
Euclidean distance,
Kolmogorov-Smirnov
statistic (*10)
URL size, no. of hyphens,
no. of dots, no. of numericcharacters, IP address,
similarity index(Levenshtein, Jaro Winkler,
Normalized Levenshtein,longest common
subsequence, Q Gram,
Hamming) (*6)
IP Address, redirection ofpage using “//”, adding
prefix or suffix separatedby “-”, subdomain andmulti-subdomain, URLs
having @ symbol (*6)
IP address, no. of dots, no.
of “/”, special
characters, abnormal lengthof domain, character
distribution (*36)

CNN

2017

RF
SVM
NN
LR
NB
RF
LSTM

2017

NB
Bayes
SVM

2018

IG
Ranker Method

2018

RF
MLP
NB
LR
J48
SVM
SVMSMOTEbSMOTE2RMR
ADASYN2018

Datasettype

1.00

digg58.com+
GitHubPhishTank+
GitHub16516+
37,66712483+
24,905Slightlyimbalanced

70.10eBay
71.01PayPal
70.10BoA
97.65Sorio

eBay+
PayPal+Bank of
America +Sorio et al.

eBay+
PayPal+ Bankof America+
Sorio
et al.

18800+
17572+
9408+ 82101

8529+
9690+
4610+
6562

Imbalanced

No. usage of domain name,
URL length, domain
separated by “-”, multiple
subdomains, usage of “@”symbol, no. of TLD in thepath, no. of suspicious
words, no. of punctuation
symbols used, digits indomain, entropy, KullbackLeibler divergence, no. of“-” in path,vowel/consonant ratio,
digit/letter ratio, usage ofbrand names, long

2017

6

2018

[45]

96.89

[46]

D1:
99.47
D2:
99.92

[47]

99.44

[48]

97.70

SearchEngine+CommonCrawl+
TwitterStream API

Alexa

98.30

2.60

Alexa+
Network
Security
Challenge

hostnames, shorthostnames, no. of “:” inhostname (*18)
Features from [49][38]

PhishTank

456300

PhishTank+
OpenPhish+
MalwareDomain List+
MalwareDomains
PhishTank+ Malware
Domain List+
Spam Domain
List
jwSpamSpy

Data set1: 90101
Data set2: 26000

26041

26041

PhishTank

3305

2892

Balanced

117 static and dynamic
features

IP address, suspicious
characters, network
protocol, alexa ranking,length of entire URL,
length of hostname, lengthof main domain name, no.
of dots in hostname,no. of dots in URL path,
URL token count,hostname token count,search engine result (*12)

ANN
LSTM

2018

CNN
CNN-LSTM
Bigram2018

J48
Simple Cart
RF
RT
ADTreeREPTree
Majority
Voting
KNN
LR
RF
DT
GBDT
XGBST
DF

2018

(*) represents number of URL-based feature
Electronic Library, vol.34, no.6, pp.927-944, 2016.
[14] A. Subasi, E. Molah, F. Almkallawi, T. J. Chaudhery, “Intelligent phishingwebsite detection using random forest classifier,” in the International
Conference on Electrical and Computing Technologies and Applications(ICECTA), pp.1-5, 2017.
[15] Z. Duo, I. Khalil, A. Khreishah, A. Al-Fuqaha, M. Guizani, “Systematizationof knowledge (SoK): a systematic review of software based web phishingdetection,” in IEEE Communications Surveys & Tutorials, vol.19, no.4,
pp.2797-2819, 2017.
[16] A. Oest, Y. Safei, A. Doupe, G. J. Ahn, B. Wardman, G. Warner, “Inside aphisher’s mind: understanding the anti-phishing eco system throughphishing kit analysis,” Proc. 2018 APWG Symposium on Electronic Crime
Research (eCrime), 2018.
[17] M. Babagoli, M. P. Aghababa, V. Solouk, “Heuristic nonliner regression
strategy for detecting phishing websites,” in Soft Computing, vol.22, no.236,
pp.1-13, 2018.

[18] E. Sorio, A. Bartoli, E. Medvet, “Detection of hidden fraudulent URLs
within trusted sites using lexical features,” in 2013 International Conference
on Availability, Reliability and Security, 2013.
[19] M. N. Feroz, S. Mengel, “Phishing URL detection using URL ranking,” Proc.
2015 IEEE International Congress on Big Data, pp.635-638, 2015.
[20] A. Hodzic, J. Kevric, “Comparison of machine learning techniques inphishing website classification,” Proc. International Conference on
Economic and Social Studies (ICESoS’16), vol.3, pp.249-256, 2016.
[21] M. Moghimi, A. Y. Varjani, “New rule-based phishing detection method,” inExpert System with Applications, vol.53, pp.231-242, 2016.
[22] P. Prakash, M. Kumar, R. R. Kompella, and M. Gupta, “Phishnet: predictive
blacklisting to detect phishing attacks,” Proc. IEEE INFOCOM, 2010, pp.15, 2010.
[23] G. Xiang and J. I. Hong, “A hybrid phish detection approach by identity
discovery and keywords retrieval,” Proc. the 18th International Conferenceon World Wide Web, pp.571-580, 2009.

7

2018

[24] V. Ramanathan and H. Wechsler, “Phishing website
detection using latent dirichlet allocation andadaboost,” in 2012 IEEE International Conferenceon Intelligence and Security Informatics (ISI),
pp.102-107, 2012.
[25] M. Aburrous and A. Khelifi, “Phishing detection plugin tool-bar using intelligent fuzzy-classification
mining techniques,” in the International Journal ofSoft Computing and Software Engineering [JSCSE],
vol.3, no.3, pp.54-61, 2013.
[26] T. Chen, T. Stepan, S. Dick, and J. Miller, “An antiphishing system employing diffused information,” inJournal of ACM Transactions on Information and
System Security (TISSEC), vol.16, no.4, pp.1-31,
2014.
[27] Y. Fu, W. Liu, and X. Deng, “EMD based visual
similarity for detection of phishing webpages,” Proc.
of International Workshop on Web Document Analysis,
2005.
[28] L. Wenyin, G. Huang, L. Xiaoyue, X. Deng, and Z.
Min, “Phishing web page detection,” in the 8 thInternational Conference on Document Analysis andRecognition (ICDAR’05), pp.560-564, 2005.
[29] Masanori Hara, Akira Yamada, and Yutaka Miyake,“Visual similarity-based phishing detection without
victim site information,” in IEEE Symposium on
Computational Intelligence in Cyber Security(CICS’09), pp.30-36, 2009.
[30] G. Liu, B. Qiu, and L. Wenyin, “Automatic detectionof phishing target from phishing webpage,” in IEEE
20 th International Conference on Pattern Recognition(ICPR), pp.4153-4156, 2010.
[31] S. Afroz and R. Greenstadt, “Phishzoo: an automatedweb phishing detection approach based on profilingand fuzzy matching,” Proc. of the 5 th IEEE
International Conference on Semantic Computing(ICSC), 2009.
[32] C. Kuan-Ta, C. Jau-Yuan, H. Chun-Rong, and C. ChuSong, “Fighting phishing with discriminative
keypoint features,” in IEEE Internet Computing,vol.13, no.3, pp.56-63, 2009 .
[33] H. Masanori, Y. Akira, and M. Yutaka, “Visual
similarity-based phishing detection without victim
site information,” in IEEE Symposium ofComputational Intelligence in Cyber Security,
CICS’09, pp.30-36, 2009.
[34] C. Teh-Chung, D. Scott, and M. James, “Detecting
visually similar web pages: application to phishingdetection,” in ACM Transactions on Internet
Technology (TOIT), vol.10, no.2, pp.1-5, 2010.
[35] Nuttapong
Sanglerdsinlapachai
and
Arnon
Rungsawang, “Using domain top-page similarity
feature in machine learning-based web phishingdetection,” in the 3 rd International Conference on
Knowledge Discovery and Data Mining, WKDD’10,
pp.187-190, 2010.
[36] H. Zhang, G. Liu, T. Chow, and W. Liu, “Textual andvisual content-based anti-phishing: a bayesian
approach,”in IEEE Transactions on Neural
Networks, vol.22, no.10, pp.1532-1546, 2011.
[37] Max-Emanuel Maurer and Dennis Herzner, “Usingvisual website similarity for phishing detection andreporting,” in ACM Conference on Extended
Abstracts on Human Factors in Computing Systems,
pp.1625-1630, 2012.

[38] H. Le, Q. Pham, D. Sahoo, S. C. H. Hoi, “URLNet:
learning a url representation with deep learning formalicious url detection,” in Journal of Computing
Research Repository (CoRR), 2018.
[39] A. K. Jain and B. B. Gupta, “Towards detection ofphishing websites on client-side using machinelearning
based
approach,”in
Journalof
Telecommunication System, vol.64, no.4, pp.687-700,
2017.
[40] A. C. Bahnsen, E. C. Bohorquez, S. Villegas, J. Vargas
and F. A. González, “Classifying phishing URLs using
recurrent neural networks,” Proc. 2017 APWG
Symposium on Electronic Crime Research (eCrime),
pp.1-8, 2017.
[41] M. Zouina and B. Outtaj, “A novel lightweight URL
phishing detection system using SVM and similarity
index,” in Journal of Human-centric Computing andInformation Sciences, vol.7, no.17, pp.1-13, 2017.
[42] S. Parekh, D. Parikh, S. Kotak and P. S. Sankhe, “A
New Method for Detection of Phishing Websites: URL
Detection,” in 2018 2 nd International Conference on
Inventive
Communication
andComputational
Technologies (ICICCT), pp.949-952, 2018.
[43] C. Liu, L. Wang, B. Lang and Y. Zhou, “Finding
Effective Classifier for Malicious URL Detection,”
Proc. the 2 nd International Conference on
Management Engineering, Software Engineering andService Sciences (ICMSS), pp.240-244, 2018.
[44] A. Ankesh, G. Kshitij, M. Joel, P. Noseong, C.
Tanmoy, C. Bei-Tseng, “Phishing URL detection withoversampling based on text generative adversarial
networks,” Proc of 2018 IEEE International
Conference on Big Data (Big Data), pp.1167-1176,
2018.
[45] S. Shivangi, P. Debnath, K. Saieevan and D.
Annapurna, “Chrome extension for malicious URLs
detection in social media applications using artificial
neural networks and long short term memory
networks,” in the International Conference on
Advances in Computing, Communications andInformatics (ICACCI), pp. 1993-1997, 2018.
[46] A. Vazhayil, R. Vinayakumar and K. Soman,“Comparative study of the detection of malicious
URLs using shallow and deep networks,” in the 9thInternational
ConferenceonComputing,Communication and Networking Technologies(ICCCNT), 2018, pp.1-6, 2018.
[47] R. P. Dharmaraj, J. B. Patil, “Malicious URLs
detection using decision tree classifiers and majority
voting technique,” in Journal of Cybernetics andInformation Technologies, vol.18, no.1, pp.11-29,
2018.
[48] H. Yuan, X. Chen, Y. Li, Z. Yang and W. Liu,
“Detecting phishing websites and targets based on
URLs and webpage links,” in the 24th International
Conference on Pattern Recognition (ICPR), pp. 36693674, 2018.
[49] D. Sahoo, C. Liu, and S. Hoi, “Malicious url detection
using machine learning: A survey,” in Computing
Research Repository (CoRR), 2017.
[50] APWG Report of Criminal Innovation Ramps Up with
Phishing Attack in 2018 by Business Wire,
Internet:https://www.businesswire.com/news/home/2
0181212005652/en/APWG-Report-CriminalInnovation-Ramps-Phishing-Attacks, Dec. 12, 2018
[Jan. 8, 2019]8