LSTM - PSO : NLP -based model for detecting Phishing Attacks (2024)

Abstract: Detecting phishing attacks involves recognizing and stopping attempts to trick users into revealing information, like passwords, credit card details or personal data without authorization. While most recent related work focus on detecting phishing attacks by analyzing, URLs, email header and content and web pages based on their content, regardless of entering text sequentially into Deep Learning (DL) algorithms. This aapproach causes the intrinsic richness of the relationship between words and part of speech to be lost. This study main contribution is to detect phishing attacks by introducing an integrated model that emphasizes on analyzing the text content of suspicious web pages a model that detects not on URL addresses. The approach of the proposed model is based on using Natural Language Processing (NLP) for processing webpage content, Particle swarm optimization algorithm (PSO) for optimizing feature extraction process and Deep Learning (DL) algorithms for classifying web page content into phishing or legitimate. NLP techniquees are used to preprocess webpage content and word2vector embeddings for Word Representation to extract and select best features into DL algorithm. Two different approaches Long Short-Term Memory (LSTM) are assessed: traditional LSTM and enhanced LSTM-PSO. The results show promising outcomes by the proposed model in detecting phishing attacks as both LSTM and LSTM-PSO achieved an accuracy of 97% and 98.3 respectively.

## introduction social engineering is a type of cyber-attack where the attacker manipulates or exploits people's behavior to deceive and scam them @xcite . social engineering attacks can be carried though phishing attack which is a cyber-attack by hackers who pretend to be an entity or organization to trick people into sharing information like usernames, passwords, credit card numbers or personal details @xcite . the attackers commonly employ methods such as sending emails, text messages, setting up deceiving websites or using social engineering strategies to deceive and exploit their targeted victims. by using strategies like urgency, authority, familiarity or offering rewards the attacker influences the victims to respond and interact with their offering. this could involve persuading them to click on links disclose data or download malicious software. once successful the attacker on obtaining users credentials or banking information they use it in activities such as identity theft or financial scams @xcite . protecting against phishing attacks requires being cautious confirming sender authenticity avoiding links or attachments updating passwords regularly and following cybersecurity practices @xcite . the main challenge in detecting phishing attacks lies in the need to effectively spot and prevent these attempts which can endanger individuals, businesses and communities. one of the technical strategies that are widely used nowadays in cyber security application domain as shown in figure1 is phishing attack detection systems @xcite . nowadays with the fast and vast spread of phishing attacks in cyber space, it is important to stay ahead of evolving phishing strategies as cyber attackers are continuously finding ways to avoid detection methods. in recent years, many studies have investigated different approaches to detect phishing attacks. these studies have made contributions to the field by incorporating model detection methods that analyze text, images, urls and user behavior patterns to enhance the accuracy of identifying phishing threats @xcite . in addition, improving the generalizability and transferability of detection models across datasets and scenarios is crucial for deployment in real world settings. in recent related work, deep learning (dl) algorithms like recurrent neural networks (rnns) or convolutional neural networks (cnns) are widely employed and was demonstrated a high accuracy rate in detecting different phishing attacks scenarios @xcite . in recent years, phishing attack considered one of the widespread security attacks which target high volume data systems such as emails, social media platforms by sending phishing text content to target victims @xcite . analyzing human language by machine require the use of nlp technique to represent human language and it is investigated in recent research works @xcite . however, in recent dl work reviewed, most attempted analyzed text of web pages without considering words sequence in the text which lack the extract of meaning and semantic of input text. therefore, there is a need to experiment different models and approaches to detect phishing attacks to address research gap and strengthen phishing detectin strategies and fortifying the security position for both individuals and organizations against phishing attacks. hence, this work is aimed to detect whether the web page is phishing or ham and the main contributions are as follows: the proposed multi-steps model of this research incorporating nlp, pso and lstm to analyze text content, refines feature selection and understands time-based relationships. moreover, these methods improve the efficiency of the detection process enabling more identification of phishing attacks. in this research work, pso algorithm is used to enhance feature selection to pick out the language cues thereby enhancing accuracy by recognizing key patterns in the text data. also, pso accelerates the convergence of the lstm model during training cutting down on training time and facilitating deployment of the phishing detection system. the following structure of this article are section 2 reviews the related work, section 3 explains proposed re methodology in detail, section 4 highlights the experiment setups and discusses results section 5 presents conclusions 2 related works in this section, a review of related work to this research study main aim of detecting phishing attack is discussed focusing on recent work used nlp and dl in detecting webpage and email suspected text content. in a study conducted by noor faisal abedin et al. @xcite , the authors discussed the ability of machine learning techniques that can predict if websites are phishing or not. these techniques use features based on urls that aim to detect websites from fake ones by examining websites' url. one of the algorithms used is the random forest classifier. this algorithm showed high accuracy results: a precision of 97% a recall of 99% and f1 score of 97% during training. this shows that the model is good at sorting websites into phishing or legitimate categories. one notable advantage of this model is its speed and efficiency. it only needs to analyze the url to make predic-tions. it doesn't require resources or features for analysis. mohammad nazmul alam et al. @xcite focus on identifying phishing attempts using machine learning techniques. random forest (rf) and decision tree (dt) are used. the authors utilized a dataset of phishing attempts probably sourced from platforms, like kaggle for the machine learning analysis. the model they proposed utilized feature selection methods such as principal component analysis (pca) to examine the characteristics of the dataset. the authors explained that feature selection is important for pinpointing the attributes that help in effectively detecting phishing attacks. they assessed the model's performance; it achieved an accuracy rate of 97% with the random forest algorithm. muhammad waqas shaukat et al. @xcite used a dataset containing 20,000 website urls to create a phishing detection model. the phishing detection model utilized a classification method involving machine learning techniques, like svm, xgboost, random forest, multilayer perceptron, linear regression, decision tree, naïve bayes and svc. through performance evaluation the model demonstrated phishing detection. xgboost displayed the performance with accuracy and precision rates of 94% during training and 91% during testing. the multilayer perceptron algorithm also showed performance, with a testing accuracy of 91%. forest and decision tree algorithms achieved accuracy rates of 91% and 90% respectively. in terms of text based classification, logistic regression and svm algorithms were employed with accuracy rates of 87% and 88% respectively. malak @xcite discusses how intelligent techniques like machine learning (ml) and deep learning (dl) are used to detect phishing websites. two different datasets were analyzed by the authors, who selected the related features for their study. these features included content-based url lexical based and domain-based characteristics. the findings highlight how feature selection impacted model performance significantly. the random forest (rf) algorithm outperform in accuracy among all models tested on both datasets. this indicates that rf perform more accurate in classifying phishing websites based on specific features. ishita saha et al. @xcite focus on identifying websites through the introduction of a data framework using deep learning techniques. traditional methods like blacklists, whitelists and antivirus programs have been employed to detect phishing attempts. the researchers suggest utilizing a perceptron (mlp) a type of feed forward network for predicting fraudulent websites. the dataset used in their research was sourced from kaggle. comprises information from ten thousand websites. the proposed model achieved an accuracy rate of 95% during training and 93% during testing. the researchers in @xcite proposed a method, for spotting phishing attacks by focusing on the text content of web pages instead of just relying on urls. they used of natural language processing (nlp) techniques and deep learning (dl) algorithms to analyse pishing attack of webpages. ther proposed approach involves an analysis of using nlp and word embedding techniques followed by incorporating this data into a dl algorithm. four different dl algorithms are assessed; long short term memory (lstm) bidirectional lstm (bilstm) gated recurrent unit (gru) and bidirectional gru (bigru). the outperforming algorithm among assesses models was bigru with an accuracy rate of 97.39%. adwan yasin and abdelmunem abuhasan et al. @xcite introduce the idea of assigning weights to phishing terms to assess how significant they are in each email. they improve the processing stage by including methods like text stemming and using wordnets vocabulary to enrich the model with word variations. the model follows knowledge discovery processes. applies five known classification algorithms for email categorization. the outcomes reveal an improvement in classification accuracy. specifically, the random forest algorithm achieves a 99.1% accuracy rate while j48 achieves 98.4%. in their research work @xcite introduces a system, for detecting phishing that uses machine learning algorithms and visual similarity analysis with natural language processing methods. the system underwent testing and the results from experiments indicated that the random forest algorithm achieved a success rate of 97.2%. benavidesastudillo et al . @xcite discusses a research project that centers on creating a user tool named ndlp phishing designed as an add on for the google chrome web browser. this tool leverages learning (dl) and natural language processing (nlp) methods to identify phishing attempts. the research involves @xcite no yes no no @xcite no yes no yes @xcite yes yes no yes proposed model yes yes yes yes 1 . although the related studies (basile et al., 2022), @xcite of ## proposed model methodology in this research work, the steps of the proposed model methodology to detect phishing attacks is shown in figure2. firstly, the data gathered contains both legitimate and non-legitimate html webpages content. secondly, the data is preprocessed b using nlp techniques such as tokenizing, parts of speech, lemmatizing and removing stop words. word2vec is then utilized for word embeddings to represent words as vectors that capture connections and semantic relationships. afterwards, the relevant features are identified through feature selection using particle swarm optimization (pso) algorithms. finally, lstm is employed to understand patterns and correlations among these features to classify and detect phishing and ham webpages' content. performance evaluation metrics, like accuracy, precision, recall and f1 score are used to assess how well the model detects phishing . ## features selection using pso in this study, the author apply particle swarm optimization (pso) algorithm which is an optimization method inspired by how natures collective behavior works. pso shows promise in enhancing detection systems. pso support the process of choosing the most relevant features that distinguish phishing attacks from legitimate content efficiently @xcite . steps of using pso for feature extraction is shown in figure 3 . the steps for using pso for feature selection are explained as follows: ## applying lstm in this study, the author assesses the performance of the lstm model by two features feedings: • word2vector direct features feeding to lstm and refered to as "lstm model" • word2vector and pso enhanced features feeding to lstm referred to as "lstm-pso model". the lstm is proven high accurate results in examining patterns in text data that unfold over time @xcite . it is used in this research due to the capability of lstm layers in analyzing the input sequence and algorithm 1 feature selection using pso 1: initialize the swarm with n particles, each representing a potential solution (binary vector of feature inclusion/exclusion). 2: initialize velocity vectors for each particle randomly. 3: evaluate the fitness of each particle based on a predefined fitness function (e.g., accuracy of a machine learning model using the selected features). 4: initialize the personal best position (pbest) of each particle to its current position. 5: initialize the global best position (gbest) to the position of the best fitness particle in the swarm. 6: while stopping criterion not met do: 7: update particle's position: apply a sigmoid function to ensure position values remain within the [0, 1] range: convert positions to binary values for feature selection: evaluate the fitness of the updated position. ## experiment setup ib this study, the author used python 3.5.2 on jupyter notebook 6.0.2 is to code nlp, pso and lstm algorithms. additionally the libararies used are, as keras, nltk, numpy, pandas, requests, scikit learn and tensorflow. these libraries offer features and utilities for tasks, like dl, nlp, data handling and model development and assessment. by using these tools, the author successfully carried out research experiment. ## evaluation metrics ib this study, the author used python 3.5.2 on jupyter notebook 6.0.2 is to code nlp, pso and lstm algorithms. additionally the libararies used are, as keras, nltk, numpy, pandas, requests, scikit learn and tensorflow. these libraries offer features and utilities for tasks, like dl, nlp, data handling and model development and assessment. by using these tools, the author successfully carried out research experiment. with regards to lstm model accuracy values as shown in figure 5 during the training process the accuracy of the model steadily increases with each epoch. starting at 92% in epoch 0 it progresses to 97% by epoch 17.5 showing that the model is learning and getting better at classifying the training data. similarly, the validation accuracy also improves as epochs increase. beginning at 94% in epoch 0 it reaches 98.5% by epoch 17.5 indicating that the model is adapting well to data and enhancing its performance over time. when comparing training and validation accuracies it is noticeable that validation accuracy consistently surpasses training accuracy. this suggests that the model is not overly fixated on the training data and can generalize effectively. the slight disparity between both accuracies implies that there is no overfitting issue. the optimal performance point is observed at epoch 17.5 where a validation accuracy of 98.5% is achieved. this indicates that the model excels in generalizing to data at this stage. however, factors like resources, training duration and potential overfitting should be considered when determining the epoch for model training. on the other hand the accuracy vlaues of lstm-pso is illustrated in figure 6. of the training set keeps improving as the epochs progress. it begins at 90% at epoch 0. steadily rises to 97% by epoch 17.5. this shows that the model is learning and getting better at classifying the training data. similarly, the validation accuracy also displays an trend with increasing epochs. it starts at 92% at epoch 0. gradually increases to 98.9% by epoch 17.5. this suggests that the model is adapting well to data and enhancing its performance over time.in comparing the training and validation accuracies we notice that the validation accuracy remains consistently higher than the training accuracy. this indicates that the model is not overly focused on fitting to the training data but can generalize effectively. the minimal difference between these two accuracies implies that there is no overfitting issue with the model, which's a positive outcome. when we look at when it achieves its validation accuracy we see that it happens during epoch 17.5 where it reaches an accuracy of 98.9%. this signifies that this stage represents performance, for generalizing to data. however, it is crucial to take into account factors like computing resources, training duration and the risk of overfitting when deciding on the epoch for model training. based on the data shown in the figure, the model reaches its peak performance around epoch 17.5 boasting a training accuracy of 98.3% and a solid validation accuracy of 98.9%. this indicates that the model has successfully grasped patterns from the training data and can generalize effectively to examples. notably the models performance shows enhancement across epochs with advancements even in the initial stages. ## conclusion in conclusion, this research study is research proposed an integrated approach to detect phishing attack webpages text content by utilizing the keras embedding layer with word2vector to capture both the meaning and structure of text found on web pages. in addition to employing word level embedding methods, the model transformed these characteristics into vector representations which were then feeded into deep learning algorithms like lstm, and the vector representation of word2vector featrures were enhanced and feeded into lstm-pso to detect phishing websites. the results of the proposed lstm-pso model indicate a higher accuracy rate of 98.3% in comparison to lstm accuracy rate of 97%. the literature review conducted in this study illustrated a gap in research studies related to the analysis of web page content using natural language processing and deep learning. most existing studies have focused on mitigating phishing emails or examining urls rather than analysing the text content of web pages an. the author aim for future work to test the model using word embedding methods such as fasttext and glove to investigate how well they perform in processing webpage text content in comparison to word2vector embbidings. moreover, the author intend to conduct phishing attacks detection using different dl algorithms and different ensemble methods of at least two dl on more data segment such as third-party information, and web content level.