Harnessing Machine Learning For Phishing Website Detection

Phishing attacks have witnessed a surge in recent years and are considered a type of cybercrime. These attacks are categorized as social engineering attacks where the perpetrator deceives users by sending fraudulent messages through social media platforms or emails. The purpose of these attacks is to extract users' information or install malicious software. Due to the cleverly designed phishing messages, even experts can fall prey to these attacks. The message often includes a phishing URL that leads the user to a counterfeit website that steals sensitive information such as login and payment information. To prevent these attacks, researchers and engineers are working towards developing methods that can detect phishing attacks without relying on expert opinion. Although several papers discuss HTML and URL-based phishing detection methods, there is no comprehensive survey available to discuss these methods. This paper aims to comprehensively survey HTML and URL phishing attacks and detection methods. We review the current state-of-the-art machine learning models that detect URL-based and hybrid-based phishing attacks in detail. We compare each model based on its data preprocessing, feature extraction, model design, and performance.