Every Character Counts: From Vulnerability to Defense in Phishing Detection
This work addresses the need for robust and explainable phishing detection tools for organizations and individuals, though it is incremental as it adapts existing neural architectures to character-level inputs.
The study tackled phishing detection by evaluating character-level deep learning models (CharCNN, CharGRU, CharBiLSTM) on a custom email dataset, finding that CharGRU performed best across standard and adversarial scenarios, with adversarial training improving robustness and Grad-CAM providing interpretability.
Phishing attacks targeting both organizations and individuals are becoming an increasingly significant threat as technology advances. Current automatic detection methods often lack explainability and robustness in detecting new phishing attacks. In this work, we investigate the effectiveness of character-level deep learning models for phishing detection, which can provide both robustness and interpretability. We evaluate three neural architectures adapted to operate at the character level, namely CharCNN, CharGRU, and CharBiLSTM, on a custom-built email dataset, which combines data from multiple sources. Their performance is analyzed under three scenarios: (i) standard training and testing, (ii) standard training and testing under adversarial attacks, and (iii) training and testing with adversarial examples. Aiming to develop a tool that operates as a browser extension, we test all models under limited computational resources. In this constrained setup, CharGRU proves to be the best-performing model across all scenarios. All models show vulnerability to adversarial attacks, but adversarial training substantially improves their robustness. In addition, by adapting the Gradient-weighted Class Activation Mapping (Grad-CAM) technique to character-level inputs, we are able to visualize which parts of each email influence the decision of each model. Our open-source code and data is released at https://github.com/chipermaria/every-character-counts.