PHISHSIM - Aiding Phishing Website Detection - With a Feature-Free Tool

Oct 25, 2026

A feature-free method detects phishing websites by using the Normalized Compression Distance (NCD) to measure similarity from compressed HTML, avoiding feature extraction and reliance on predefined website attributes. The approach computes similarity against known phishing sites, selects representative phishing prototypes via the Furthest Point First algorithm, and supports adaptive detection through incremental learning when concept drift occurs. Experiments on a large dataset show strong performance with AUC 98.68%, TPR ~90%, and FPR 0.58%, running in about 0.3 seconds and using prototypes to reduce long-term storage needs.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages16

Reading Time40 min

AccessFree to download

Introduction

Feature-free phishing detection approach

Prototype extraction and representative clustering

Incremental learning for concept drift

Experimental results and deployment considerations

PHISHSIM: Aiding Phishing Website Detection With a Feature-Free Tool Rizka Widyarini Purwanto , Graduate Student Member, IEEE, Arindam Pal , Senior Member, IEEE , Alan Blair, and Sanjay Jha , Senior Member, IEEE Abstract—In this paper, we propose a feature-free method for detecting phishing websites using the Normalized Compression Distance (NCD), a parameter-free similarity measure which computes the similarity of two websites by compressing them, thus eliminating the need to perform any feature extraction. It also removes any dependence on a speciﬁc set of website features. This method examines the HTML of webpages and computes their similarity with known phishing websites, in order to classify them. We use the Furthest Point First algorithm to perform phishing prototype extractions, in order to select instances that are representative of a cluster of phishing webpages. We also introduce the use of an incremental learning algorithm as a framework for continuous and adaptive detection without extracting new features when concept drift occurs. On a large dataset, our proposed method signiﬁcantly outperforms previous methods in detecting phishing websites, with an AUC score of 98.68%, a high true positive rate (TPR) of around 90%, while maintaining a low false positive rate (FPR) of 0.58% . Our approach uses prototypes, eliminating the need to retain long term data in the future, and is feasible to deploy in real systems with a processing time of roughly 0.3 seconds. Index Terms—Phishing detection, webpage, incremental learning, feature-free methods. I. INTRODUCTION PHISHING is deﬁned as a cyber-attack which uses social engineering via digital means to persuade victims to disclose their personal information, such as their password or credit card number [13] . The strategies used in phishing Manuscript received September 21, 2021; revised January 1, 2022 and February 8, 2022; accepted March 15, 2022 . Date of publication April 1, 2022; date of current version April 15, 2022 . This work was supported by the Cyber Security Cooperative Research Centre Ltd., whose activities are funded by the Australian Government’s Cooperative Research Centres Programme. The work of Rizka Widyarini Purwanto was supported by the University of New South Wales (UNSW) University International Postgraduate Award (UIPA) Scholarship. The associate editor coordinating the review of this manuscript and approving it for publication was Prof. Xiaodong Lin. (Corresponding author: Rizka Widyarini Purwanto.) Rizka Widyarini Purwanto is with the School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW 2052, Australia, also with the Cyber Security Cooperative Research Centre, Joondalup, WA 6027, Australia, and also with the UNSW Institute for Cyber Security (IFCYBER), Campbell ACT 2612, Australia (e-mail: [r.purwanto@unsw.edu.au](r.purwanto@unsw.edu.au)). Arindam Pal is with the School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW 2052, Australia, also with the CSIRO Data61, Sydney, NSW 2015, Australia, also with the Cyber Security Cooperative Research Centre, Joondalup, WA 6027, Australia, and also with the UNSW Institute for Cyber Security (IFCYBER), Campbell ACT 2612, Australia. Alan Blair and Sanjay Jha are with the School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW 2052, Australia, and also with the UNSW Institute for Cyber Security (IFCYBER), Campbell ACT 2612, Australia. Digital Object Identiﬁer 10.1109/TIFS.2022.3164212 attacks exploit human vulnerabilities in distinguishing between authentic and phishing messages or websites [29] . Phishing is a low-cost, yet essential tool to aid various cyber-attacks, as it is often used as the key step in advanced persistent threats. With our ever-increasing reliance on various digital platforms, phishing has become a versatile weapon in the attacker’s arsenal. Despite the

FAQs

How does PHISHSIM detect phishing websites without feature extraction?

It computes similarity between webpage HTML and known phishing websites using Normalized Compression Distance (NCD), which relies on compression rather than extracting predefined features.

What role does the Furthest Point First algorithm play?

It extracts phishing prototypes by selecting instances that best represent clusters of phishing webpages.

How does the method handle concept drift over time?

It introduces an incremental learning framework that continuously adapts detection without extracting new features when the underlying patterns change.

Oct 25, 2026

Upload by Lucas Martin