A scalable phishing website detection model based on dual-branch TCN and mask attention

Abstract

Phishing website detection models face challenges such as missing features, limited feature extraction capabilities, and significant computational resource consumption when processing multidimensional features. Additionally, publicly available datasets often lack diversity and scalability, and are vulnerable to disguise attacks, resulting in poor model generalizability.This paper addresses these issues by proposing a multiclass scalable dataset, Crawling2024, collected using a WebDriver-based collector that simulates human operations to avoid attacker disguises. Through data analysis, we identify handcrafted features from access information and URLs. These features help reduce the computational load of deep learning models and expand feature dimensions. Crawling2024 retains data identifiers (IDs), enabling further extension through data scraping.We also introduce a scalable phishing website detection model (SPWDM) that utilizes a dual-branch temporal convolution network (TCN) to extract local correlations and long-term dependencies of domain names. The model incorporates a lightweight spatial-channel (SC) attention mechanism to enhance interactions between channels and space. Additionally, it uses a mask attention mechanism to manage extended features and adjust focus when features are missing. Our feature fusion method combines enhanced features extracted by the dual-branch TCN, with various features processed by the mask attention mechanism.The experimental results demonstrate that our proposed detection method achieves excellent performance, with an accuracy of 97.66% on the Crawling2024 dataset. This is 0.52% to 2.72% higher than other methods, and it maintains a leading position on other public datasets.