# HinPhish: An Effective Phishing Detection Approach Based on Heterogeneous Information Networks
## 1 Introduction  
Phishing is a very common and dangerous attack campaign. With the popularization of network technology, the cost of phishing attacks has been reduced significantly. Phishers can deploy a mimic website with low cost and high efficiency by utilizing various phish kits [1]. Then, these websites convince victims to leak their sensitive credentials, such as passwords, phone numbers, bank accounts, credit card numbers, and other private information. Phishing attacks have been become one of the major cybersecurity threats. They may not only cause the victim to suffer economic losses, but can also destroy the reputation of the imitated website. According to the report published by the Anti-Phishing Working Group (APWG) [2], after experiencing a rapid growth in 2020 (doubling over the course of the year), the number of phishing attacks in January 2021 reached its peak in the APWG's records, as shown in Figure 1. The trend of phishing attacks is becoming worse. To evade detection, attackers leverage various cloaking techniques to arm phishing pages. [PERSON] et al. [1] analyzed the nature of server-side.haccess filtering techniques and discovered that attackers can launch a targeted attack by customized whitelist filters. For example, when the visiting IP is from the U.S., the phishing sites will return the phishing page and, otherwise, return a normal page. [PERSON] et al. [3] studied the blackhat cloaking techniques of ten prominent cloaking services and pointed out that they hinder the detection of protection mechanisms. [PERSON] et al. [4] provided the first broad perspective of client-side cloaking techniques, demonstrating how an attacker can display specific content to different users through the use of client-side cloaking techniques. In recent years, researchers have developed various anti-phishing techniques to combat phishers. These techniques detect phishing attacks by utilizing different data, including URLs, page source codes, page screenshots, third-party data, and so on. For example, the basis of list-based techniques is the ability to collect and consolidate URLs. To date, researchers have focused on how to automatically collect and generate more effective lists. Visual similarity-based techniques can display the detection results more intuitively. [PERSON] et al. [5] recognized the brands of phishing webpages by localizing and classifying the target brand logos involved in page screenshots through the sole use of computer vision methods in an object detection task. In addition, machine learning-based approaches are also worthy of attention, which leverage multi-dimensional features to detect phishing pages. Nevertheless, there are still many drawbacks which remain unsolved [6] in existing phishing detection techniques. List-based techniques are incapable of discovering zero-day attacks, and visual similarity-based techniques can be bypassed by changing the location or pixels of elements in webpages. In addition, there are some drawbacks of implementation, such as the excessive computational burden, third-party dependencies, etc. The root cause of the traditional methods being bypassed is the discrete features and single focus, which can lead to a lack of attention to the relationships between phishing websites. From another perspective, approaches that significantly increase the cost of phishing attacks may effectively reduce the occurrence of attacks. In practice, we have found that many out-of-domain links usually appear on the pages of phishing websites. Although normal websites sometimes link outside of the domain, it has been observed, in a large number of analyses, that the more links outside the domain, the greater the possibility that a website is a phishing website. Our aim is to effectively prevent and reduce such attacks. Motivated by this, we propose HinPish, with the core idea that every webpage on the Internet cannot exist independently, and will always be connected to other pages, such as forwarding pages and loading resources.