BEAM - An Algorithm for Detecting Phishing Link

Abstract

This paper aims to develop an attention-based phishing detector by performing sub-word tokenization and fme-tuning the Bidirectional Encoder Representation from Transformers (BERT) model. It is called BERT embedding attention model (BEAM). Our proposed BEAM method contains five building blocks: a data pre-processing block to extract components according to the URL structure, a tokenization block to tokenize the individual URL components into a number of sub-words, an embedding block to produce a numerical sequence representation, an encoding block to give a context feature vector and a classification block for phishing URL detection. The subword tokenization allows us to characterize the relationship among connecting subwords, while the attention mechanism in the BERT allows the proposed model to focus selectively on important parts contributing to phishing behavior. We have compared our proposed BEAM method with other existing state-of-the-art phishing detection methods such as CNN, Bi-LSTM, and machine learning models (random forest and XGBoost). Experimental results confirm that our proposed BEAM method effectively detects phishing links and outperforms other existing methods.