Phishing attacks reached a record high in 2022, as reported by the Anti-Phishing Work Group, following an upward trend accelerated during the pandemic. Attackers employ increasingly sophisticated tools in their attempts to deceive unaware users into divulging confidential information. Recently, the research community has turned to the utilization of screenshots of legitimate and malicious websites to identify the brands that attackers aim to impersonate. In the field of Computer Vision, convolutional neural networks (CNNs) have been employed to analyze the visual rendering of websites, addressing the problem of phishing detection. However, along with the development of these new models, arose the need to understand their inner workings and the rationale behind each prediction. Answering the question, “How is this website attempting to steal the identity of a well-known brand?” becomes crucial when protecting end-users from such threats. In cybersecurity, the application of explainable AI (XAI) is an emerging approach that aims to answer such questions. In this article, we propose VORTEX, a phishing website detection solution equipped with the capability to explain how a screenshot attempts to impersonate a specific brand. We conduct an extensive analysis of XAI methods for the phishing detection problem and demonstrate that VORTEX provides meaningful explanations regarding the detection results. Additionally, we evaluate the robustness of our model against Adversarial Example attacks. We adapt these attacks to the VORTEX architecture and evaluate their efficacy across multiple models and datasets. Our results show that VORTEX achieves superior accuracy compared to previous models, and learns semantically meaningful patterns to provide actionable explanations about phishing websites. Finally, VORTEX demonstrates an acceptable level of robustness against adversarial example attacks.

This study investigates the use of explainable artificial intelligence (XAI) to identify the unique features distinguishing malware families and subspecies. The proposed method, called the color-coded attribute graph (CAG), employs XAI and visualization techniques to create a visual representation of malware samples. The CAG utilizes the feature importance scores (ISs) obtained from a pre-trained classifier model and a scale function to normalize the scores for visualization. The approach assigns each family a representative color. The features are color-coded according to their relevance to the malware family. This work evaluates the proposed method on a dataset of 13,823 Internet of Things malware samples and compares two approaches for feature IS extraction using Linear Support Vector Machine and Local Interpretable Model-Agnostic Explanations. The experimental results demonstrate the effectiveness of the CAG in interpreting machine learning-based methods for malware detection and classification, leading to more accurate analyses.

Clicking on the wrong link and downloading a malware or leaking confidential information has been a common threat to everyone. Novel defense mechanisms against web threats have emerged, from URL parsing via Machine Learning to JavaScript deep graph analysis. In this study, we consider the problem of generating Adversarial Examples to evade URL classifiers. We propose a neural network architecture that will be able to generate synthetic URLs for a variety of attacks that will evade existing security classifiers. The main focus of the literature is on classifiers for phishing URLs, but in this work we aim to extend it to other attacks like Drive-by-Download. Our system splits the URL at the word level before substituting words with symbols. This approach contrasts with the existing literature that works on the character level without semantic considerations. We also envision a combination of the word level generation with a character level analysis by a Convolutional Neural Network to improve the evasion capacity of the synthetic samples.

Phishing has persistently posed threats to the World Wide Web as phishing websites evolve over these years. Many previous works were devoted to extracting useful features and focused on the essential components of phishing websites. One of the essential components is sensitive inputs which require sensitive information. Yet, due to a large variety of web designs, detecting the existence of sensitive inputs is not trivial. Some previous works have provided rule-based approaches to detect login forms, which contain sensitive inputs, using HTML codes. However, the novel phishing websites modify HTML codes against the detection rules, which causes less accurate detection.To overcome the limitation of previous works, we proposed SenseInput using hybrid deep learning models to detect the existence of sensitive inputs and sensitive information because phishing websites eventually present sensitive inputs in their visual content. SenseInput achieved 96.94% f1-score for sensitive input detection on our dataset and 96.73% f1-score on a public dataset, Phishpedia Phish30K. Next, we used 22 features involving the proposed seven statistical features and two sensitive input features for phishing detection. The experiment shows that our approach achieves 98.48% and 95.87% f1-score on our validation and Phishpedia datasets, outperforming previous approaches. Finally, we investigated the influence of sensitive input features. The result shows that our sensitive input features are more effective than the rule-based login form. Besides, the experiment also indicates that proposed sensitive input features can reduce the impact of bias between different datasets.

Websites can spread malware and phishing scams, and this represents a significant risk to users. To block such malicious websites, various organizations and individuals, e.g., security vendors, analyze URLs and create blocklists. Some blocklists are paid and some are free public blocklists; however, the effectiveness of public blocklists is generally not guaranteed. Thus, many studies have attempted to verify their effectiveness. To the best of our knowledge, public blocklist providers (PBP) have not been studied as rigorously as blocklists, and it is still unclear how blocklists should be operated and how PBP websites should be designed to maintain the effectiveness. Therefore, to unveil more characteristics of the PBP, we designed a measurement study to analyze PBPs in terms of lifespan, update frequency, entry bias, and user interface metrics. In this paper, we describe the results of measuring seven PBPs according to these four metrics.