Seok-Jun Bu  Hae-Jung Kim

10.5626/JOK.2021.48.2.147

phishing URL classification convolutional-recurrent triplet network deep metric learning cyber-security

Automated classification of phishing URLs propagated through hyperlinks is critical in environments reinforcing personal connections due to the explosive growth of social media services. Deep learning models for the classification of phishing URLs based on convolutional-recurrent neural networks yielded the best performance in terms of accuracy by modeling the character-level and word-level features. However, the deep learning-based classifier focused on the fitting of a given task via accumulated URLs is limited due to the class imbalance of the phishing attacks that are generated and discarded immediately. We address the class imbalance issue in terms of deep learning-based URL feature space generation task. We propose a modified triplet network structure that explicitly learns the similarity between URLs based on Euclidean distance to alleviate the limitations of the existing deep phishing classifiers. Experiments investigating the real-world dataset of 60,000 URLs collected from web addresses showed the highest performance among the latest deep learning methods, despite the hostile class imbalance. We also demonstrate that the generated URL feature space from the proposed method improved recall by 45.85% compared to the existing methods.