[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-653345-105":59,"doc-detail-653345-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","phishsim-aiding-phishing-website-detection-with-a-feature-free-tool","PHISHSIM - Aiding Phishing Website Detection - With a Feature-Free Tool","","A feature-free method detects phishing websites by using the Normalized Compression Distance (NCD) to measure similarity from compressed HTML, avoiding feature extraction and reliance on predefined website attributes. The approach computes similarity against known phishing sites, selects representative phishing prototypes via the Furthest Point First algorithm, and supports adaptive detection through incremental learning when concept drift occurs. Experiments on a large dataset show strong performance with AUC 98.68%, TPR ~90%, and FPR 0.58%, running in about 0.3 seconds and using prototypes to reduce long-term storage needs.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/phishsim-aiding-phishing-website-detection-with-a-feature-free-tool/653345/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/phishsim-aiding-phishing-website-detection-with-a-feature-free-tool/653345.png","ImageObject",300,407,{"name":92,"@type":93},"Lucas Martin","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-26","2026-10-25",true,{"@type":102,"interactionType":103,"userInteractionCount":8},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"How does PHISHSIM detect phishing websites without feature extraction?","Question",{"text":112,"@type":113},"It computes similarity between webpage HTML and known phishing websites using Normalized Compression Distance (NCD), which relies on compression rather than extracting predefined features.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What role does the Furthest Point First algorithm play?",{"text":117,"@type":113},"It extracts phishing prototypes by selecting instances that best represent clusters of phishing webpages.",{"name":119,"@type":110,"acceptedAnswer":120},"How does the method handle concept drift over time?",{"text":121,"@type":113},"It introduces an incremental learning framework that continuously adapts detection without extracting new features when the underlying patterns change.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},653345,1793051622,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":8,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":36},8796095360427,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","PHISHSIM: Aiding Phishing Website Detection  \nWith a Feature-Free Tool  \nRizka Widyarini Purwanto , Graduate Student Member, IEEE, Arindam Pal , Senior Member, IEEE ,  \nAlan Blair, and Sanjay Jha , Senior Member, IEEE  \nAbstract—In this paper, we propose a feature-free method for detecting phishing websites using the Normalized Compression Distance (NCD), a parameter-free similarity measure which computes the similarity of two websites by compressing them, thus eliminating the need to perform any feature extraction. It also removes any dependence on a specific set of website features. This method examines the HTML of webpages and computes their similarity with known phishing websites, in order to classify them. We use the Furthest Point First algorithm to perform phishing prototype extractions, in order to select instances that are representative of a cluster of phishing webpages. We also introduce the use of an incremental learning algorithm as a framework for continuous and adaptive detection without extracting new features when concept drift occurs. On a large dataset, our proposed method significantly outperforms previous methods in detecting phishing websites, with an AUC score of 98.68%, a high true positive rate (TPR) of around 90%, while maintaining a low false positive rate (FPR) of 0.58% . Our approach uses prototypes, eliminating the need to retain long term data in the future, and is feasible to deploy in real systems with a processing time of roughly 0.3 seconds.  \nIndex Terms—Phishing detection, webpage, incremental learning, feature-free methods.  \nI. INTRODUCTION  \nPHISHING is defined as a cyber-attack which uses social  \nengineering via digital means to persuade victims to disclose their personal information, such as their password or credit card number [13] . The strategies used in phishing  \nManuscript received September 21, 2021; revised January 1, 2022 and February 8, 2022; accepted March 15, 2022 . Date of publication April 1, 2022; date of current version April 15, 2022 . This work was supported by the Cyber Security Cooperative Research Centre Ltd., whose activities are funded by the Australian Government’s Cooperative Research Centres Programme. The work of Rizka Widyarini Purwanto was supported by the University of New South Wales (UNSW) University International Postgraduate Award (UIPA) Scholarship. The associate editor coordinating the review of this manuscript and approving it for publication was Prof. Xiaodong Lin. (Corresponding author: Rizka Widyarini Purwanto.)  \nRizka Widyarini Purwanto is with the School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW 2052, Australia, also with the Cyber Security Cooperative Research Centre, Joondalup, WA 6027, Australia, and also with the UNSW Institute for Cyber Security (IFCYBER), Campbell ACT 2612, Australia (e-mail: [r.purwanto@unsw.edu.au](r.purwanto@unsw.edu.au)).  \nArindam Pal is with the School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW 2052, Australia, also with the CSIRO Data61, Sydney, NSW 2015, Australia, also with the Cyber Security Cooperative Research Centre, Joondalup, WA 6027, Australia, and also with the UNSW Institute for Cyber Security (IFCYBER), Campbell ACT 2612, Australia.  \nAlan Blair and Sanjay Jha are with the School of Computer Science and Engineering, University of New South Wales (UNSW), Sydney, NSW 2052, Australia, and also with the UNSW Institute for Cyber Security (IFCYBER), Campbell ACT 2612, Australia.  \nDigital Object Identifier 10.1109/TIFS.2022.3164212  \nattacks exploit human vulnerabilities in distinguishing between authentic and phishing messages or websites [29] . Phishing is a low-cost, yet essential tool to aid various cyber-attacks, as it is often used as the key step in advanced persistent threats. With our ever-increasing reliance on various digital platforms, phishing has become a versatile weapon in the attacker’s arsenal. Despite the","cbCaik2eoypqQuDZ","https://ap.wps.com/l/cbCaik2eoypqQuDZ","pdf",4942748,16,"English","# Introduction\n## Feature-free phishing detection approach\n## Prototype extraction and representative clustering\n## Incremental learning for concept drift\n## Experimental results and deployment considerations","[{\"question\":\"How does PHISHSIM detect phishing websites without feature extraction?\",\"answer\":\"It computes similarity between webpage HTML and known phishing websites using Normalized Compression Distance (NCD), which relies on compression rather than extracting predefined features.\"},{\"question\":\"What role does the Furthest Point First algorithm play?\",\"answer\":\"It extracts phishing prototypes by selecting instances that best represent clusters of phishing webpages.\"},{\"question\":\"How does the method handle concept drift over time?\",\"answer\":\"It introduces an incremental learning framework that continuously adapts detection without extracting new features when the underlying patterns change.\"}]","PHISHSIM - Aiding Phishing Website Detection - With a Feature-Free Tool | PDF",1792888784]