Look Before You Leap: Detecting Phishing Web Pages by Exploiting Raw URL And HTML Characteristics

1. Introduction

• The paper motivates phishing detection by the scale of attacks and notes that blacklist and whitelist methods can miss zero-day attacks because their lists are not exhaustive.It describes phishing as a low-cost attack requiring limited technical skill and reports that Gmail intercepted over 100 million spam emails daily in April 2020.Source: §1 · pp. 1–2
• Handcrafted-feature approaches require specialized domain knowledge and continuing updates, while models using predefined features can struggle to extrapolate to new data.The introduction also notes that URL-only and HTML-only deep-learning studies have been common, although the two page components provide different characteristics.Source: §1 · pp. 2–3
• WebPhish embeds URL characters and HTML words, concatenates their matrices, and uses convolutional layers to model semantic relationships.The stated objectives include accurate detection using raw URL and HTML content, without third-party systems or handcrafted features.Source: §1 · p. 3
• The model is presented as reducing manual feature engineering and avoiding reliance on third-party systems while learning representations from raw URL and HTML content.The authors state that its learned representation accommodates new web content and can be applied to test data.Source: §1 · p. 3
• WebPhish significantly outperforms state-of-the-art methods in an evaluation using collected real-world data.The paper also reports an ablation study on other textual datasets to demonstrate adaptability beyond the proposed domain.Source: §1 · p. 3

2. Related Works

• The reviewed machine-learning approaches commonly classify pages using extracted lexical, statistical, URL, HTML, or DNS features, including NLP-derived representations.The section surveys both manual feature engineering and automatic feature extraction.Source: §2 · p. 4, §2.1 · p. 4

2.1. Phishing Detection Using Machine Learning Algorithms with Handcrafted Features

• Handcrafted-feature approaches can require platform-specific expertise and may struggle to extrapolate to new data; some also depend on legitimate-page content that phishers need not fully replicate.The section gives examples of approaches that combine complex feature sets or use extracted features in conventional classifiers.Source: §2.1 · pp. 6–7

2.2. Phishing Detection Using Automatic Feature selection on Deep Neural Networks

• Other reviewed automatic-feature approaches use neural networks, recurrent units, or multimodal inputs to detect phishing pages and URLs.Examples include DNN and LSTM combinations, a variational-autoencoder model using text, image, and URL features, and a GRU applied to URL character features.Source: §2.2 · pp. 7–8
• Deep-learning studies include URL-only and hybrid approaches, while WebPhish combines character-level URL and word-level HTML embeddings before convolution without expert feature engineering.The section contrasts this approach with prior URL-focused models and notes that many reviewed methods still use handcrafted features.Source: §2.2 · pp. 7, 10

3. The Proposed Model

• WebPhish classifies pages as legitimate or phishing from concatenated URL-character and HTML-word representations, followed by convolutional, fully connected, and sigmoid output layers.The model learns URL and HTML representations as embedding matrices before concatenating them.Source: §3 · pp. 10–11, §3.2.5 · p. 14

3.1. Input Layer

• URLs are tokenized as character sequences, while HTML is split into word sequences with punctuation treated as separate tokens.The HTML corpus contains 321,009 unique words.Source: §3.1 · p. 12

3.2. Deep Neural Network

• The DNN comprises five layers: embedding, concatenation, convolution, fully connected, and output.These layers form the model’s stated architecture.Source: §3.2 · p. 12

3.2.1. Embedding Layer

• The embedding layer converts tokenized URL characters and HTML words into feature vectors, with embedding weights adjusted during training by backpropagation.URL sequences are represented with D = 16 and length 180; the paper also describes padding or truncation to fixed lengths based on dataset lengths.Source: §3.2.1 · pp. 12–13

3.2.2. Concatenation Layer

• Concatenation combines URL-character and HTML-word embeddings, expanding the vocabulary representation while preserving the original content information.The paper says this also helps capture rare words and sub-word-level information.Source: §3.2.2 · p. 13

3.2.3. The Convolutional Neural Network

• The convolution layer applies 32 filters and 8 kernels to the (2180, 16) concatenated representation; max pooling downsamples it to [1090 x 32 x 8].The pooled output is passed to the following fully connected layers.Source: §3.2.3 · p. 14

3.2.4. Fully Connected Layer

• Two fully connected layers analyze and merge features from the convolutional and max-pooling layers, applying ReLU in each layer.Source: §3.2.4 · p. 14

3.2.5. Output Layer

• The sigmoid output layer maps the model’s result to a value from 0 to 1 for the legitimate and phishing classes.The output follows the fully connected layers.Source: §3.2.5 · p. 14

4.1. Research Questions

• The evaluation asks how WebPhish compares with deep-learning and hand-crafted-feature baselines, how alternatives perform, and how it fares on the US Airline dataset.The alternatives include LSTM and URL-only or HTML-only inputs.Source: §4.1 · p. 15

4.3. WebPhish Experimental Setup and Metrics

• Grid search varied CNN and fully connected layer counts from 1–3 and compared RMSProp with Adam across learning rates from 0.0001 to 0.1.The selected setup used Adam at a learning rate of 0.0015 and batch size 20.Source: §4.3 · p. 16

4.4. Evaluation Metrics

• Evaluation uses recall, precision, accuracy, ROC and precision-recall curves, and five-fold cross-validation.The paper describes the precision-recall curve against recall values and uses cross-validation with k set to 5.Source: §4.4 · pp. 16–17

5. Results

• The section evaluates the proposed phishing detection method and reports results in relation to each research question.Source: §5 · p. 17

5.1. Comparing WebPhish with State-of-the-Art Baselines (RQ 5.1)

• The benchmark spans URL-token CNNs, URL-character LSTMs and GRUs, HTML CNNs, and TF-IDF features applied to XGBoost.The compared methods include Wei et al. (2019), Bahnsen et al. (2017), Opara et al. (2020), Tang & Mahmoud (2021), and Aljofey et al. (2022).Source: §5.1 · pp. 17–18
• On the dataset, WebPhish performed best across all metrics; concatenating URL-character and HTML-word embeddings produced the highest accuracies by leveraging increased vocabulary and sequential patterns in textual content.Source: §5.1 · p. 18
• At FPR values of 0.2, 0.3, and 0.4, WebPhish achieves better recall than Bahnsen et al. (2017); Opara et al. (2020) is the other approach with meaningful recall at lower FPRs.As FPR decreases, the gap between WebPhish and baselines grows, except for Opara et al. (2020), whose approach has high computational cost.Source: Figure 3 · p. 18, §5.1 · pp. 18–19

5.1.1. Performance of the WebPhish Model in terms of Computational Time

• Training takes approximately twice as long as Bahnsen et al. (2017), but website evaluation takes 0.094 seconds, below the cited 2-second acceptable wait time.The paper reports greater computational complexity than other benchmarked methods except Wei et al. (2019).Source: §5.1.1 · p. 19

5.2. Comparing WebPhish with Hand-Crafted Features Trained on Simpler Baseline Models (RQ2)

• The comparison uses 31 features drawn from prior work and evaluates logistic regression, kernel SVM, and random forest against WebPhish.The traditional classifiers were selected as relevant baselines for sequence-detection systems.Source: §5.2 · p. 19

5.2.1. URL Features

• URL features include ambiguous terms, digit counts, URL length, subdomains, dots, and punctuation that may characterize phishing URLs.The paper describes terms such as “admin” and “account” as potentially misleading URL elements.Source: §5.2.1 · p. 21

5.2.2. HTML Features

• HTML features include whitespace, internal and external links, and the number or presence of images.Source: §5.2.2 · p. 22
• At least 2% accuracy improvement is reported for WebPhish over the traditional classifiers across categories and metrics.Table 5 reports precision, recall, and F1 score comparisons.Source: Table 5 · p. 22, §5.2.2 · p. 22
• The random-forest ROC curve outperforms logistic regression and SVM among the traditional classifiers.The paper describes its curve as farther from the hyperplane.Source: Figure 4 · p. 22, §5.2.2 · p. 23
• WebPhish correctly predicted approximately 98% of 2,252 phishing test instances, versus 88% for SVM, 87% for logistic regression, and 94% for random forest.The paper presents these results as evidence of limitations in the hand-crafted features.Source: §5.2.2 · p. 22
• On the 4,538-instance test set, WebPhish correctly classified 2,202 phishing and 2,237 legitimate instances, yielding 98.1% precision.The passage identifies Table 6 as the confusion matrix comparing WebPhish with traditional classifiers.Source: Table 6 · p. 23, §5.2.2 · p. 23

5.3. Alternative Technical options for WebPhish (RQ3)

• The alternatives test an LSTM using URL and HTML, a CNN using only URL input, and a CNN using only HTML input.The paper compares these technical options with the combined end-to-end WebPhish framework.Source: §5.3 · pp. 23–24
• WebPhish averages 98.1% across precision, F1 score, and recall, and achieves the lowest FPR of 2% by combining URL and HTML input.The paper reports that its precision, recall, and F1 values are well balanced.Source: Table 7 · p. 24, §5.3 · pp. 24–25
• Option3, trained on HTML alone, performs worst across evaluated metrics; Option1, the LSTM, is closer to WebPhish but takes longer to train.The paper attributes the HTML-only result to phishing pages copying legitimate page source code.Source: §5.3 · p. 24
• In the dataset, “login” appears 99.8% more often in phishing than legitimate URLs, and the model uses text semantics and co-occurrence to classify pages.Source: §5.3 · p. 24

5.4. Application on Sentiment classification (RQ4)

• The evaluation used 14,640 US airline tweets and tested WebPhish on positive and negative sentiment classification.The authors trained and evaluated on full and abridged datasets to account for prior studies that excluded neutral tweets.Source: §5.4 · p. 25, §5.4.1 · pp. 25, 27

5.4.1. Implementation

• The comparison included prior sentiment-analysis systems using voting classifiers, TF-IDF features, Doc2Vec embeddings, and recurrent networks.Rustam et al. (2019) and Tang & Liu (2016) used the full corpus, whereas Naseem & Musial (2019) and Khan & Malviya (2020) removed the neutral class.Source: §5.4.1 · pp. 26–27
• 94% accuracy: WebPhish worked better than other models on the US airlines dataset.The paper also reports a significant efficiency improvement over state-of-the-art techniques trained on US airline Twitter datasets.Source: Table 8 · p. 26, Table 9 · p. 26, §5.4.1 · p. 27

6.1. Why does WebPhish outperform the baselines?

• Combining raw URL and HTML avoids manual feature engineering; the two inputs provide complementary information when one component is spoofed.The model uses URL character and HTML word embeddings; character embeddings can accommodate unseen words, while either component alone may miss structural or obfuscated information.Source: §6.1 · pp. 27–28
• Concatenating URL and HTML embeddings before convolution preserves original content information, unlike approaches that concatenate convolution outputs.The authors report that this design demonstrated value in their experiments.Source: §6.1 · p. 28

6.2. How does WebPhish perform on cloned websites?

• When HTML is cloned word for word, WebPhish relies on the URL; misspelled or homographic URLs are addressed through character embeddings.The discussion also says the model can evaluate the full URL disclosed when a user clicks a shortened URL.Source: §6.2 · pp. 28–29

6.3. The Importance of the Number of Layers in the DNN on the Phishing Detection Accuracy

• 98.1% accuracy with 2 FC layers exceeded the 97.9% with 1 layer and 98% with 3; 2 CNN layers balanced 98.1% accuracy with 491 seconds of training.The 1- and 3-CNN configurations achieved 98% accuracy in 475 seconds and 98.1% in 492 seconds, respectively.Source: Table 10 · p. 29, Table 11 · p. 29, §6.3 · p. 29
• Replacing embeddings with hand-crafted features shortened training time but caused a 4% drop across all metrics.The authors interpret this as evidence that character embeddings matter for URL and HTML text analysis and that manual feature engineering can overlook salient distinctions.Source: Table 12 · p. 29, §6.3 · p. 30

6.4. Limitations of WebPhish

• Rare content manipulations may cause missed zero-day attacks and require retraining; pages dominated by images or Flash cannot be classified by this non-visual model.Source: §6.4 · p. 30

• WebPhish uses CNNs and character and word embeddings to automatically extract features from raw URL and HTML content.Source: §7 · p. 30
• At 0.094 seconds per website, the authors say real-time deployment would not negatively affect usability.Source: §7 · p. 30
• The authors identify evaluation against other phishing attacks, such as spear phishing, as future work.Source: §7 · p. 30