PaperlayerView exact revision on arXiv

Source-linked AI summary

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

Unai Agirre, Imanol Jerico, Felipe Castaño, Andrea Venturi, Francesco Zola

arXiv:2608.16158v1cs.LGcs.AIcs.ET

TL;DR

Existing phishing defenses often analyze isolated instances, leaving structural reuse and organized attack patterns insufficiently addressed. This paper represents webpages as DOM trees, clusters structural and tag-based features, and finds that the approach reveals recurrent phishing templates, with content features producing more specific but more fragmented groupings.

  • Problem

    Existing binary phishing models focus on individual instances and do not capture broader attack infrastructure or relationships needed to analyze authorship and template patterns.

  • Method

    The study constructs DOM trees, extracts structural and optional HTML-tag features, clusters webpages with three methods, and evaluates cluster quality using level-wise Jaccard comparisons.

  • Results

    DOM-tree representations yield meaningful phishing webpage groupings, while content features produce more specific template variants but increase noisy and singleton clusters.

  • Takeaways & Limitations

    DOM-based clustering supports phishing template analysis without prior labels by exposing recurrent structural patterns and fine-grained homogeneous variants.

  • Takeaways & Limitations

    Content-based clustering leaves many samples unclustered or isolated, so substantial portions of the dataset may remain unanalyzed.

Abstract

from arXiv · show

Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats

I. INTRODUCTION · II. BACKGROUND · A. Clustering

The study addresses phishing’s escalating, industrialized threat by testing whether DOM-tree structure can fingerprint template reuse and reveal coordinated campaigns. It compares unsupervised clustering representations and validates the effects of tree depth and a level-wise Jaccard Distance Score.

  • I. INTRODUCTION: Over 1 million unique phishing attacks were detected in early 2025, marking the highest quarterly volume since late 2023.The resurgence shows strong sector-specific targeting, including SaaS and Webmail categories.
  • I. INTRODUCTION: Reactive blocklists and supervised classifiers identify individual malicious instances but miss attack infrastructure context and structural signatures of organized actors.This limitation motivates analysis beyond isolated phishing events.
  • I. INTRODUCTION: The study evaluates HTML structure as a robust fingerprint for identifying malicious-site similarities and systematic phishing-template reuse.The intended result is a stable indicator of phishing structural logic.
  • I. INTRODUCTION: DOM parent–child trees provide structural and optional HTML-tag content features for unsupervised clustering without prior labels.Generated groups receive quantitative and qualitative validation.
  • I. INTRODUCTION: The framework targets emergent and zero-day templates by revealing reusable structures, supporting characterization and attribution of coordinated phishing campaigns.Its focus on structures is intended to adapt beyond static or supervised detection rules.
  • I. INTRODUCTION: The contributions validate DOM-derived tree representations, compare three clustering methodologies with structural or HTML-tag features, assess tree-depth effects, and introduce a level-wise Jaccard Distance Score.These contributions collectively define the study’s representation, clustering, depth-analysis, and quantitative-validation agenda.
  • A. Clustering: Clustering groups structurally similar phishing templates without labels, using density-based methods for arbitrary-shaped groups and outlier separation alongside hierarchical similarity organization.DBSCAN avoids specifying cluster count and identifies noise, while AHC builds nested groups but remains sensitive to distance and linkage choices.

B. Related Work · 1) Phishing Detection as Binary Classification: · 2) Phishing Template Analysis:

Related work divides phishing analysis between binary classification for immediate malicious-instance detection and post-detection analysis of structural patterns, infrastructures, and forensic markers. Although classification models report high accuracy, template-analysis methods instead use structural similarity, graph fingerprints, and unsupervised learning to uncover relationships across attacks.

  • B. Related Work: Phishing analysis comprises binary classification for immediate mitigation and post-detection analysis of structural patterns, shared infrastructures, and forensic markers.These approaches provide complementary perspectives on phishing activity.
  • 1) Phishing Detection as Binary Classification:: 96% accuracy was achieved by a BERT-based approach that uses semantic analysis of URL strings to avoid manual feature engineering.The approach was proposed by Otieno et al. and uses bidirectional Transformers to capture contextual URL representations.
  • 1) Phishing Detection as Binary Classification:: 98.9% average accuracy was achieved by PhishTransformer on a balanced dataset of 50,000 samples using CNNs and Transformers to analyze embedded HTML URL links.The method supplements primary-URL analysis with HTML web-page source information.
  • 1) Phishing Detection as Binary Classification:: Binary classification models isolate malicious samples effectively but provide limited adversarial insight because they categorize isolated events.Their event-level focus does not capture the broader attack context or relationships between samples.
  • 1) Phishing Detection as Binary Classification:: Traditional binary models are insufficient for identifying systemic signatures of organized actors because they do not analyze attack infrastructure, authorship, or phishing-template relationships.This limitation motivates methods focused on patterns within attacks.
  • 2) Phishing Template Analysis:: 0% false-negative rate was achieved at specific thresholds by comparing DOM trees with genetic algorithms to identify structural clones of legitimate pages.At δ = 0.6, the method achieved high accuracy but remained sensitive to obfuscation and exposed a false-positive/false-negative trade-off.
  • 2) Phishing Template Analysis:: 172 distinct attacks against a single financial institution were uncovered by PhiKitA using HTML-DOM graphs, MD5 hashing, and structural fingerprints to link phishing kits with deployed websites.The dataset was designed to connect generative phishing kits to their website counterparts.
  • 2) Phishing Template Analysis:: Unsupervised methodologies are required to discover latent relationships across heterogeneous file types and attack vectors because annotated datasets are scarce for supervised learning.Althobaiti et al. evaluated Mean Shift and DBSCAN for grouping corporate email threats.

III. METHODOLOGY · A. Phase 1: Data Preprocessing · B. Phase 2: Tree Construction

The methodology analyzes phishing webpage similarity through DOM-based tree representations, feature extraction, clustering, and validation. Its first phases preprocess HTML data and construct hierarchical trees that preserve document structure while enabling attribution to shared attackers or templates.

  • III. METHODOLOGY: DOM information produces tree-based representations and structural or content-based features for identifying pages likely deployed by the same attacker or created from the same template or phishing kit.
  • III. METHODOLOGY: The methodology comprises four steps: data preprocessing, tree construction, feature extraction and clustering, and validation.
  • A. Phase 1: Data Preprocessing: The evaluation uses the DS-2 subset of Aljofey et al.’s dataset because it contains full HTML source code required for Phase 2’s tree-based representation.The corpus was collected during 2023 and published in 2025.
  • A. Phase 1: Data Preprocessing: Phase 1 starts from phishing webpages’ HTML content and prepares it for constructing a tree-based representation of each page’s DOM.
  • B. Phase 2: Tree Construction: Each HTML element or tag becomes a tree node, while edges represent parent–child relationships to preserve the original document’s hierarchical structure.
  • B. Phase 2: Tree Construction: Each tree depth defines a level: the root at level 0 is <html>, with <head> and <body> as its immediate level-1 children.
  • B. Phase 2: Tree Construction: Nodes receive unique identifiers combining tag name, depth level, local child index, and cumulative traversal counter to prevent collisions among identical tags.

C. Phase 3: Feature Extraction & Clustering · D. Phase 4: Validation

Phase 3 converts DOM trees into structural and content-based feature vectors for clustering webpages with similar characteristics. Phase 4 validates the resulting groups quantitatively with LJ D and qualitatively through representative medoid inspection.

  • C. Phase 3: Feature Extraction & Clustering: Five structural properties characterize each DOM tree’s overall shape and complexity, complemented by content-based information.The study extracts two feature groups: structural properties and an extended representation incorporating content-based information.
  • C. Phase 3: Feature Extraction & Clustering: The extracted features convert trees into numerical vectors that support mathematical comparison, aggregation, and clustering of webpages with similar characteristics.Clustering is used to identify latent patterns and templates that may not be apparent through manual inspection.
  • D. Phase 4: Validation: Clustering outputs are evaluated quantitatively with a dedicated Jaccard-distance metric and qualitatively through visual inspection of representative samples.This phase combines numerical and visual evaluation of the groups generated by the clustering algorithms.
  • D. Phase 4: Validation: The Level-wise Jaccard Distance Score (LJ D) compares HTML tag-frequency distributions across DOM levels to assess within-cluster similarity and between-cluster dissimilarity.The metric evaluates whether samples in the same cluster have similar level-wise tag distributions while samples in different clusters remain sufficiently dissimilar.
  • D. Phase 4: Validation: The LJ D weighting excludes the first two DOM levels and assigns larger weights to upper levels than deeper levels because higher-level differences better reflect global structural changes.The first two levels usually represent common top-level HTML structure.
  • D. Phase 4: Validation: For each cluster, LJ D combines intra-cluster compactness and inter-cluster separation; small values indicate compact, well-separated clusters, whereas high values indicate greater relative dispersion.The algorithm-level LJ DA vector contains one LJ D(Ci) value for every cluster in the generated partition.
  • D. Phase 4: Validation: LJ DA mean summarizes overall cluster quality, LJ DA std measures score variability, and LJ DA max identifies the most problematic cluster.Singleton clusters are excluded from LJ DA std computations because LJ Dintra(Ci) is undefined for them.
  • D. Phase 4: Validation: Qualitative validation selects the N most compact clusters using the lowest LJ Dintra values, then compares their medoids and visualized structural graphs for representative and distinguishable patterns.The medoids are analyzed and visualized using Gephi.

IV. EXPERIMENTAL STUDY · A. Dataset

The experimental evaluation uses the DS-2 subset of Aljofey et al.’s dataset because it provides full HTML source code required for tree-based representation. Collected in 2023 and published in 2025, the corpus reflects current evasion tactics and modern web design patterns.

  • A. Dataset: The study evaluates its methodology on the DS-2 subset of the dataset developed by Aljofey et al..DS-2 is the specific subset selected for the experiments.
  • A. Dataset: Full HTML source code was essential because Phase 1 represents webpages as trees.The dataset was selected specifically to satisfy this tree-based representation requirement.
  • A. Dataset: Collected during 2023 and published in 2025, the corpus captures current evasion tactics and modern web design patterns.These properties make it a benchmark for structural analysis.

B. Experiment setup · C. Model configurations · V. RESULTS

The study varies DOM-tree depth to examine its effect on structural detail and webpage similarity, then compares tuned clustering algorithms using established metrics before quantitative and qualitative validation.

  • B. Experiment setup: Eight DOM-tree depths are evaluated to determine how representation depth affects captured structural detail and resulting webpage similarity.The study varies the number of considered DOM levels as part of the clustering analysis.
  • B. Experiment setup: Qualitative validation uses N = 3 representative compact clusters and C = 2 additional samples per cluster.Only clusters containing more than 4 elements are included in this analysis.
  • C. Model configurations: Three algorithms are compared: DBSCAN, OPTICS, and hierarchical Agglomerative-AHC.DBSCAN and OPTICS are density-based methods, whereas Agglomerative-AHC is hierarchical.
  • C. Model configurations: Grid search varies ϵ or xi and min_samples for density-based methods, while hierarchical clustering uses different distance thresholds.The hierarchical distance thresholds are reported in Table II.
  • C. Model configurations: Configuration selection uses the Silhouette Coefficient (Sscore), Calinski-Harabasz Index (CHindex), and Davies-Bouldin Index (DBindex).These metrics identify the best configuration for each algorithm at each considered analysis level.
  • C. Model configurations: The grid search initially uses only structural properties of the webpages.The supplied passage introduces this structural-only search before describing subsequent validation.
  • C. Model configurations: LJ D is excluded from the search and instead used after configuration selection for quantitative and qualitative validation.The search prioritizes established metrics, while LJ D supports later validation of the selected configurations.

A. Grid-search results · B. Structural and content-based features contribution analysis · DBSCAN OPTICS AHC

Grid search identifies stable parameter settings for DBSCAN, OPTICS, and AHC across DOM-tree depths. Structural features generally outperform content-enriched representations, with content information increasing uncertainty and outlier proportions for several algorithms.

  • A. Grid-search results: DBSCAN achieves its highest Sscore with ϵ = 0.6 at levels 8, 9, 11, 12, and 13, but uses ϵ = 0.5 at level 15.At levels 10 and 14, the peak shifts toward lower-density configurations while retaining ϵ = 0.6.
  • A. Grid-search results: OPTICS consistently selects min_samples = 2, with xi = 0.1 except at level 10, where xi = 0.2.
  • A. Grid-search results: AHC achieves its highest Sscore across all levels with the same threshold t = 75.
  • B. Structural and content-based features contribution analysis: OPTICS attains the highest Sscore, with values greater than 0.75 across all eight evaluated levels, but performs worst on DBindex and CHindex.DBSCAN and AHC achieve lower DBindex values, while AHC also attains higher CHindex values.
  • DBSCAN OPTICS AHC: OPTICS produces a relatively large number of clusters and No% ∈[6.66%, 7.34%], whereas DBSCAN has No% ≤1.04% and AHC produces no singletons.
  • DBSCAN OPTICS AHC: Content-based features deteriorate OPTICS performance, increasing DBindex and lowering Sscore and CHindex, while No% rises to approximately 20% to 32%.
  • DBSCAN OPTICS AHC: With content-based features, DBSCAN has Nc > 286 and approximately 20-24% outliers, despite slightly higher Sscore values than with structural features.Its DBindex and CHindex performance becomes poorer.
  • DBSCAN OPTICS AHC: Structural-only models perform better at levels 14, 11, and 14 for DBSCAN, OPTICS, and AHC respectively, while content-based DBSCAN and OPTICS perform better at level 8.Only four cases achieve at least two best metrics at the same level: structural AHC at level 14, content-based DBSCAN and OPTICS at level 8, and content-based AHC at level 15.

VI. CLUSTER VALIDATION · A. Quantitative Validation

Quantitative validation uses the level-wise Jaccard Distance Score to compare the best configuration of each clustering algorithm. Content features yield the lowest scores for all three algorithms, with DBSCAN achieving the overall minimum of 0.158.

  • A. Quantitative Validation: Table IV reports the level-wise Jaccard Distance Score for each algorithm’s best configuration.The score was introduced in Section III-D.
  • A. Quantitative Validation: Content features produce the lowest LJ Dmean values for all three algorithms.The added information lowers the average ratio between cluster compactness and dispersion.
  • A. Quantitative Validation: 0.158 is the overall lowest LJ Dmean value, achieved by DBSCAN with content features.This result suggests improved clustering when content information is incorporated.

B. Qualitative Validation · C. Discussion

Qualitative analyses show that DOM-tree clustering identifies visually coherent phishing webpage groups, while discussion results emphasize a trade-off between broad structural reuse and more specific but fragmented template variants. Clustering behavior also depends on DOM depth, feature type, and webpage regularity.

  • B. Qualitative Validation: The three most compact structural clusters excluded LJ D(C) = 0 and revealed shared <head> structures, with S2 and S3 also similar in <body> structure.The clusters were labeled S1, S2, and S3; medoids and two samples from each cluster were visualized.
  • B. Qualitative Validation: Content-enriched clusters had substantially different medoids, while SC1 contained nearly identical trees differing only by one <head> change and SC2 contained larger, deeper trees.The content-enriched clusters were labeled SC1, SC2, and SC3, with medoids and samples visualized.
  • B. Qualitative Validation: Qualitative inspection also examined medoids from the most dispersed clusters to provide a more comprehensive view of cluster structure.These additional medoids were reported in Appendix B.
  • C. Discussion: DOM-tree representations supported meaningful clustering of phishing webpages, but algorithms reacted differently to structural versus structural-content information and DOM depth.With structural features alone, the best configurations tended to occur at deeper DOM levels; with content incorporated, density-based methods generally favored shallower levels.
  • C. Discussion: Structural features capture broad DOM properties and reuse patterns, whereas content-based features reduce LJ Dmean and identify more specific template variants.Content information also increases fragmentation because tag-level descriptions are more specific and variable.
  • C. Discussion: Visually coherent compact clusters support the possibility that phishing kits, reusable templates, and shared web components generate webpages with similar internal structures despite domain differences.The qualitative findings are consistent with structural reuse across phishing webpages.
  • C. Discussion: Tree-based comparison is more difficult for webpages using minimal HTML, redirection mechanisms, dynamically generated content, or incomplete or obfuscated structures.These characteristics may expose less structural regularity for clustering.

D. Limitation & Future Work · E. Ethics Concerns · VII. CONCLUSION

The study identifies limitations in content-based clustering, ethical risks involving privacy, dual use, and attribution, and concludes that DOM-based clustering can reveal phishing template reuse without prior labels. Structural and tag-level content features, together with LJ D and qualitative validation, support this approach as promising for phishing analysis.

  • D. Limitation & Future Work: Content-based features achieved the best overall performance under the introduced metric but produced many unclustered elements or singleton groups.DBSCAN and OPTICS produced unclustered elements, while AHC produced singleton groups.
  • E. Ethics Concerns: The dataset may contain inadvertently exposed personally identifiable information, including email addresses, names, and telephone numbers.The webpages were primarily publicly accessible and collected for security research purposes.
  • E. Ethics Concerns: The methodology presents dual-use risks because inferred structural and behavioural insights could help malicious actors make phishing campaigns more sophisticated and evasive.Its intended use is to characterise phishing infrastructure and improve detection and defensive mechanisms.
  • E. Ethics Concerns: Structural similarity may indicate commonalities between phishing webpages but does not definitively establish shared authorship or attacker identity.Attribution-related conclusions should remain probabilistic and be used exclusively for defensive and threat intelligence purposes.
  • VII. CONCLUSION: Representing phishing webpages as DOM trees and clustering structural or content-based features can identify structural similarities and potential template reuse without prior labels.The conclusion frames HTML structure as a potentially reliable fingerprint for this analysis.
  • VII. CONCLUSION: Structural features capture broader DOM organization, while tag-level content information enables finer-grained identification of highly homogeneous template variants.The LJ D metric and qualitative validation further support that compact clusters correspond to visually coherent tree structures.

APPENDIX A GRID-SEARCH RESULTS (PART II) · APPENDIX B QUALITATIVE VALIDATION - PART II

Appendix A evaluates clustering configurations that combine structural and content-based features, selecting the best-performing settings for Section V-B. Appendix B qualitatively examines compactness-related results through medoids, highlighting heterogeneous and highly flattened DOM configurations in dispersed clusters.

  • APPENDIX A GRID-SEARCH RESULTS (PART II): The grid search combines structural information with content-based features rather than using structural information alone.The resulting configurations are evaluated in Figures 9, 10, and 8.
  • APPENDIX A GRID-SEARCH RESULTS (PART II): The best-performing configurations in Figures 9, 10, and 8 are highlighted with red boxes.These selected configurations are subsequently used in Section V-B.
  • APPENDIX B QUALITATIVE VALIDATION - PART II: Figure 11 reports medoids for clusters with the highest LJ D(C) values, comparing three structural-only clusters with three combined-feature clusters.The comparison concerns dispersed clusters and contrasts with the compact clusters shown in Figures 6 and 7.
  • APPENDIX B QUALITATIVE VALIDATION - PART II: The dispersed-cluster medoids exhibit more heterogeneous configurations than the compact-cluster medoids.The reported configurations include trees with reduced depth and simplified structures.
  • APPENDIX A GRID-SEARCH RESULTS (PART II): Figure 8 reports AHC Sscore during the grid search with structural and content-based features.AHC is evaluated alongside DBSCAN and OPTICS in the combined-feature search.
  • APPENDIX B QUALITATIVE VALIDATION - PART II: After removing the first two DOM levels, corresponding to <html> and <head>/<body>, the remaining structure is almost completely flattened.This describes the reduced-depth configurations observed in the dispersed-cluster analysis.
  • APPENDIX A GRID-SEARCH RESULTS (PART II): Figure 9 reports DBSCAN Sscore during the grid search with structural and content-based features.The figure represents one of the three configuration searches used to identify settings for Section V-B.
  • APPENDIX A GRID-SEARCH RESULTS (PART II): Figure 10 reports OPTICS Sscore during the grid search with structural and content-based features.The figure contributes to the configuration selection later used in Section V-B.
Loading 2608.16158v1…